By Allan Juma, Lead Cybersecurity Engineer at ESET
On 21 October, the PHP project released emergency fixes for two critical flaws in the PHP engine. Tracked as CVE-2026-109618 and CVE-2026-109619 and now widely referred to as PHP2Shell, the flaws allow unauthenticated remote code execution and can impact all PHP installations serving web requests.
In practical terms, it means anyone can make a vulnerable server run their code and each flaw was rated by PHP as 9.2 on the CVSS v4 scale. Attackers can also read passwords and tokens and API keys from PHP process memory that then opens routes into cloud accounts and other services. For the Kenyan organisation, perhaps the most important question is to ask what customer-facing or revenue-generating services rely on a PHP application, and what happens if one of them is taken over?
The weakness sits in the PHP runtime which means that a website’s usual housekeeping won’t close it. The fix has to happen on the server and companies still running PHP 8.1 or older, which the PHP project no longer releases updates for, are facing a tougher task than a routine upgrade. Fixes are available through distribution vendors or long-term support providers and companies should check if they are available through a backported fix or upgrade to a supported release. PHP has also published minimal source backports for versions 7.4, 8.0 and 8.1.
For Kenyan organisations, the immediate priority is to establish which websites, applications and hosted services depend on PHP and whether the underlying runtime has been patched. The Dutch national Cyber Security Centre’s operational guidance recommends identifying PHP-based applications and runtime versions, prioritising internet-facing systems and checking products that bundle PHP. These are practical exposure checks that can help minimise if not mitigate the risks.
These PHP vulnerabilities arrive against a backdrop of rising web application attack attempts in Kenya. In its April-June 2026 report, the National KE-CIRT/CC recorded 17,406, 495 web application attack attempts targeting the critical information infrastructure sector, an increase of 43.68% on January-March 2026. The report identifies unauthenticated remote code execution, privilege escalation and reflected cross-site scripting among the vulnerabilities exploited.
PHP2Shell falls into the first of these vulnerability classes but that doesn’t mean that the earlier Kenyan attacks involved this vulnerability. The report also highlights how many companies still have inadequate system patching, insufficient awareness of phishing and other social engineering attacks, alongside an increase in malicious actors exploiting AI technologies.
The story has not ended with the PHP emergency patches released in the week 21 October. On 23 October, PHP warned of an additional remote-code-execution issue, CVE-2026-115560, that’s affecting applications with an unusual combination of session configuration and application code. PHP is planning on addressing the issue in its next regular bugfix release but has provided companies with recommendations to address the issue for now.
PHP has not been the only urgent patching priority in October. The US National Vulnerability Database recorded that Windows vulnerability CVE-2026-96951 was published on 13 October 2026. And on Tuesday 17 October, Microsoft’s Patch Tuesday was the largest on record fixing 1,400 flaws. AI is also changing the threat environment – the Kenya National KE-CIRT/CC says AI-assisted reconnaissance helped cybercriminals identify vulnerable systems more rapidly while AI-powered malware and automated vulnerability discovery reduced the time between identifying and exploiting security weaknesses.
Protection and preparation start with knowing where PHP runs so inventory your PHP-based websites, portals and applications, including third-party services and products that bundle PHP. Identify applications and runtime versions and ask your hosting providers, developers and managed service providers for written confirmation of affected services. Patching also doesn’t establish if a server was compromised so monitor your internet-facing logs and use suspicious findings to trigger your incident-response process.
Security right now means prioritising speed and visibility. For PHP2Shell, patch immediately and isolate any internet-facing applications if a fix can’t be applied promptly. Do an accurate inventory of your affected systems and monitor for any suspicious activity. Threat intelligence is also important here, KE-CIRT recommends enhanced intelligence sharing to improve resilience against evolving threats. The practical lesson today is for Kenyan companies to make system visibility, urgent remediation and incident response established operating practices before the next critical vulnerability is exposed.
