The Cyber Security Authority (CSA) and the National Information Technology Agency (NITA) have directed all government institutions in Ghana to address two critical cybersecurity vulnerabilities within seven days and report the remedial actions taken to the two agencies.
The directive follows a joint public cybersecurity alert issued on October 22, 2026, warning government institutions, businesses, website owners, hosting providers and operators of Critical Information Infrastructure about vulnerabilities in PHP, a programming language widely used to power websites and online services.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and referred to as “PHP2Shell,” could allow attackers to take control of affected servers without requiring a username or password.
According to the alert, successful exploitation could expose sensitive information, disrupt online services and enable further attacks against an organisation’s network.
Security Patches Released
The two agencies disclosed that the PHP Project had released security fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Affected organisations have been urged to install the appropriate fixed versions, later supported releases or vendor packages confirmed to contain the necessary security updates.
The agencies cautioned that updating website themes or plugins alone would not resolve vulnerabilities in the underlying PHP software.
Organisations that cannot immediately install the updates have been advised to consider temporarily taking affected services offline until they can be secured.
Organisations Urged to Check for Attacks
As part of the immediate response measures, the CSA and NITA have called on organisations to identify all websites, web applications and servers running PHP, including systems managed by external service providers.
Priority should be given to internet-facing systems and essential public services.
Organisations have also been advised to review system logs, investigate unusual processes, check for unexpected administrator accounts and identify unauthorised changes to website files.
Any systems suspected of being compromised should be isolated, with relevant evidence preserved for investigation.
The agencies further urged website owners to obtain written confirmation from hosting providers, developers and system administrators that affected systems have been identified and patched.
NITA to Coordinate Government Response
Under the directive, NITA will coordinate technical support for government digital assets and services, while the CSA will coordinate cybersecurity incident reporting and response.
Heads of government institutions have been asked to ensure that their ICT teams and service providers act urgently to address the vulnerabilities.
Institutions are also expected to maintain updated inventories of their digital assets and nominate responsible officers to support remediation and coordination under NITA’s Government Digital Assurance Programme (GovDAP).
Public Warned Against Fake Security Updates
The CSA and NITA have cautioned the public against messages asking users to download purported PHP security updates, disclose passwords or provide payment details.
Website owners have been advised to obtain security updates only through official software sources or verified service providers.
The agencies stressed that all affected organisations must treat the alert as urgent and take immediate steps to protect their systems.
Individuals and organisations who suspect a cybersecurity incident or system compromise can contact the CSA by calling or sending an SMS to 292, or by emailing report@csa.gov.gh.
By: Bernard Mensah
Discussion about this post