The government has issued a critical cybersecurity advisory warning ministries, departments and agencies of serious vulnerabilities affecting PHP, a programming language widely used to power websites, web applications and digital service platforms.
The advisory, dated October 21, 2026, was issued by the State Department for ICT and the Digital Economy in collaboration with the ICT Authority, directing all government institutions to urgently identify potentially affected systems and implement the necessary security measures.
The warning follows the identification of two critical PHP vulnerabilities, each assigned a severity score of 9.2 on the Common Vulnerability Scoring System (CVSS), indicating a high level of risk.
According to the advisory, the vulnerabilities could expose affected systems to remote code execution, a security threat that may allow attackers to run malicious commands on vulnerable servers from a remote location.
The government cautioned that successful exploitation could compromise the confidentiality, integrity and availability of government information systems and online public services.
PHP is widely used in the development and operation of websites and web-based applications, making the vulnerabilities a potential concern for institutions that rely on the technology to deliver digital services to the public.
The advisory requires government institutions to identify websites, web applications, servers and other systems running PHP, with priority given to internet-facing platforms and critical digital services.
ICT departments have also been directed to establish whether third-party applications, hosting platforms and managed service providers use vulnerable PHP components.
System administrators are expected to prepare to install the relevant security updates and verify the affected software versions and fixes against official PHP security guidance and vendor advisories before deployment.
The advisory states that institutions should apply the appropriate security updates as soon as they become available and ensure that the affected systems are properly secured.
Where an exposed system cannot be secured promptly, institutions have been advised to assess whether external access should be restricted or the affected service temporarily taken offline until effective mitigation measures are implemented.
Such decisions should be coordinated with the relevant service owners to minimise disruption to government operations and public services.
The government has further directed ICT teams to strengthen security monitoring by reviewing web server, application, endpoint and network logs for unusual requests, unauthorised access, unexpected file modifications, suspicious processes and other possible signs of compromise.
Institutions have also been advised to review and strengthen web application firewall rules, access controls and other security protections.
However, the advisory cautions that temporary protective measures should not be treated as a substitute for installing official security updates.
Government institutions have additionally been instructed to engage hosting providers, software developers and other service providers to establish whether their systems are exposed, confirm remediation arrangements and obtain assurance that affected components have been secured.
Where a cybersecurity breach is suspected or detected, the institutions are required to activate the relevant incident response procedures, preserve logs and other evidence, and promptly report the incident through established government cybersecurity reporting channels.
The ICT Authority will coordinate technical guidance and support to government institutions as they identify affected systems, undertake remediation and monitor compliance with the recommended measures.
ICT directors and system administrators have been directed to prioritise remedial action according to the level of exposure and the criticality of the affected services. They must also maintain records of actions taken and escalate unresolved high-risk vulnerabilities through established government ICT and cybersecurity coordination mechanisms.
Institutions unable to implement the required measures immediately must document the outstanding risks, existing compensating controls and planned timelines for addressing the vulnerabilities.
The advisory requires all government institutions to treat the warning as urgent and take the necessary technical and administrative steps to safeguard government websites, information systems and digital public services.
Further technical guidance is expected as additional information becomes available from the PHP security team and other recognised cybersecurity authorities.
The alert underscores the importance of timely software updates, continuous monitoring and coordinated incident response as government agencies increasingly rely on digital platforms to provide services and manage sensitive information.
