The government has issued an urgent cybersecurity warning to all ministries, departments and agencies over critical software flaws that could allow attackers to run unauthorised commands on government websites, web applications and other digital systems.
In an advisory dated October 21, 2026, the Ministry of Information, Communications and the Digital Economy, through the State Department for ICT and the Digital Economy, directed public institutions to identify potentially affected systems and prepare to install security updates as soon as they become available.
The warning, issued in collaboration with the ICT Authority, followed an alert by the PHP security team on two critical vulnerabilities, both of which received a severity rating of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS).
PHP is a widely used programming language that runs on servers and supports websites, web applications and online service platforms.
The ministry cautioned that the flaws could put the confidentiality, integrity and availability of government information systems at risk, raising concerns about the security of digital platforms used to deliver public services.
“The vulnerabilities have the potential to expose affected systems to remote code execution,” the advisory stated.
Remote code execution happens when an attacker exploits a weakness in a system to run unauthorised code or commands. If successful, such an attack could give the attacker further access to applications, information and other systems connected to the affected platform.
Agencies Ordered to Check Systems
As part of the response, government institutions have been directed to establish which of their websites, web applications, servers and other digital systems use PHP.
The ministry instructed agencies to give priority to platforms accessible through the internet, as well as critical digital services whose disruption could affect government operations or access to public services.
Institutions must also check whether software supplied by third parties, hosting platforms and managed services depend on PHP components that could be affected by the reported vulnerabilities.
The directive requires administrators to prepare for the immediate installation of the relevant security updates once they are officially released. According to the advisory, the PHP security team had scheduled the updates for October 21, 2026.
However, the ministry warned system administrators against making decisions based on unconfirmed information when identifying affected systems or deciding which fixes to apply.
“Administrators should verify the applicable fixes and affected versions against official PHP guidance and vendor advisories before deployment,” the advisory stated.
The checks are intended to help institutions establish their level of exposure and ensure that the correct updates are applied to the affected software.
The government has also directed agencies to consider limiting external access to vulnerable systems where necessary, particularly when the security weaknesses cannot be addressed immediately.
Institutions may temporarily take affected platforms offline if they cannot secure them promptly. However, such decisions must be coordinated with the relevant service owners to reduce disruption to government operations and services relied on by the public.
The advisory further requires government institutions to strengthen their monitoring of possible cyberattacks by examining web server, application, endpoint and network logs for signs of suspicious activity.
Administrators have been asked to look for unusual requests, unauthorised access attempts, unexpected changes to files, suspicious processes and other signs that an attacker may have gained access to a system.
Agencies have also been directed to strengthen web application firewall rules, access controls and other security measures that could help limit exposure while permanent fixes are being prepared or installed.
The ministry, however, cautioned that these temporary safeguards must not be treated as a substitute for installing the official security updates.
Government institutions must work with hosting companies, software developers and other service providers to determine whether their systems are affected by the vulnerabilities.
The engagement is intended to establish whether vulnerable PHP components are present and confirm that the necessary security measures have been implemented.
The directive places responsibility on agencies to look beyond systems managed directly by their own ICT teams and establish whether external platforms supporting their services could also be exposed.
Where an institution suspects or confirms that a system has been compromised, it must activate its incident response procedures, preserve relevant logs and other evidence, and report the incident promptly through established government cybersecurity reporting channels.
These steps are intended to support investigations, help determine the extent of any breach and guide the response to potential attacks.
The ICT Authority will coordinate technical guidance and provide support to government institutions as they identify vulnerable systems, apply security measures and monitor compliance with the advisory.
ICT directors and system administrators have been instructed to prioritise their response according to the level of exposure and the importance of the affected services.
They must keep records of the actions taken to address the vulnerabilities and escalate high-risk exposures that remain unresolved through the established government ICT and cybersecurity coordination channels.
Institutions that cannot implement the required measures immediately must document the risks that remain, the alternative security controls already in place and the timelines for completing the necessary fixes.
The requirement is intended to ensure that outstanding security weaknesses are tracked and that institutions have clear plans for addressing risks they cannot resolve at once.
The ministry said all government institutions must treat the advisory as urgent and take the necessary technical and administrative steps to protect government websites, information systems and digital public services.
Further technical guidance will be issued as more information becomes available from the PHP security team and other recognised cybersecurity authorities.