PUBLIC STATEMENT ON MAJOR SECURITY FLAWS IN PHP. THE SOFTWARE BEHIND MOST OF THE WORLD’S WEBSITES

The problem, made public on 21st October 2026 and now commonly called “PHP2Shell”, is made up of two separate weaknesses that security experts have rated as highly critical. In simple terms, they can allow a criminal to break into the computer that runs a website without needing any password, take full control of it, steal private information such as passwords and personal data, and damage or shut down the website. Of particular concern is that these weaknesses exist within PHP itself, and not in any single website. As a result, every website running an affected version of PHP is at risk, regardless of how well its own code was written. This includes sites built on popular platforms such as WordPress, Joomla and Drupal, as well as many custom-built business and government systems. Every version of PHP released over the past decade is affected. The Association also notes that information on how to exploit these vulnerabilities is already circulating publicly. Organisations should therefore treat this matter as urgent and act without delay. CSEAG strongly advises all website owners, administrators and hosting providers to update PHP to the latest secure versions (8.2.35, 8.3.36, 8.4.27 or 8.5.12) immediately; to contact their web developers or hosting companies to confirm that the update has been applied; and, where an immediate update is not possible, to engage a qualified security professional to put protective measures in place. The Association further urges all institutions, especially those within Ghana’s critical sectors, to cooperate with the Cyber Security Authority (CSA) and to report any suspected compromise through the national reporting channels (CERT-GH). CSEAG remains committed to supporting a safe and resilient digital Ghana. The Association’s members are available to provide technical guidance and support to organisations affected by this issue. Affected businesses and organisations that need expert assistance can visit the CSEAG Experts Directory at cyberexpertgh.org/experts to find and request the services of accredited cybersecurity professionals.