Two serious bugs in PHP let an attacker take over a web server without a password. Cyber agencies in four African countries have told organisations to update.
Two critical flaws in PHP, nicknamed PHP2Shell, could let an attacker run commands on a web server without logging in. They are tracked as CVE-2026-109618 and CVE-2026-109619. PHP released fixes on 21 October 2026. Agencies in Cameroon, Djibouti, Ghana and Nigeria have passed on the alert. If your site, shop or service runs on PHP, ask whoever hosts it whether it has been updated.
PHP is a programming language that runs a large share of the web. One report puts it behind nearly 70% of sites whose server-side language is known. The two bugs sit in its core. They were rated 9.2 out of 10 on the CVSS v4.0 scale. An attacker who uses them could run commands on the server and reach data stored there. The risk covers PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Security outlets say mod_php setups face the greatest danger.
The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older no longer get regular updates from the project. The PHP team issued small fixes for 7.4, 8.0 and 8.1, and users should ask their Linux provider or support vendor for them.
The danger is not just theory. BleepingComputer reports that Cloudflare saw early attacks on both flaws before the fixes came out. Help Net Security reports that Amazon’s threat team logged an attempt on 17 October, four days before the public release. Officials in the UK urge firms to update at once, or take affected systems offline until they can.
The flaws do not single out Africa. Still, news sites, online shops and government service portals on a vulnerable PHP version are at risk, wherever the server sits. A service run by an African firm can be exposed even if it is hosted abroad.
African agencies have moved fast. Cameroon’s CIRT.cm, part of ANTIC, issued an alert on 22 October. Djibouti’s national cybersecurity authority published its own notice. In Ghana, the Cyber Security Authority and NITA alerted government bodies, firms and hosting providers. Public institutions were asked to act and report back within seven days. In Nigeria, ngCERT rated the flaws critical. It urged government bodies, banks, telecom firms and hosting providers to find exposed systems and patch them.
Updating is the main fix. List every system that runs PHP, check the version, and install a fixed one. Updating a website or content management system may not be enough if the server’s PHP engine is still old. If you pay a company to host your site, ask it to confirm the update. A patch does not undo an earlier break-in, so check for signs of one.
Why it matters: PHP runs sites of every size, often through a host or an agency. One unpatched server can expose customer data. A quick check now costs far less than a breach later.
What to watch next: more national alerts, reports of attacks on African sites, and whether hosts and agencies confirm that their servers are updated.
Sources: BleepingComputer on the PHP2Shell patches; Help Net Security on PHP2Shell; Canadian Centre for Cyber Security alert AL26-026; Kaspersky on the PHP flaws.
A note for startup founders: Don’t practice on investors. Practice on AI first. RaiseReady by Index Prima is an AI fundraising simulator for African founders: upload your pitch deck, get a readiness score and face a tough AI investor before the real meeting. Find this post, and every post we publish, at raiseready.indexprima.com.
