The Ministry of Information, Communications and the Digital Economy has directed government institutions to strengthen the security of their websites and online applications following the discovery of critical vulnerabilities in PHP, a programming language widely used to power digital platforms.
In a statement issued on Wednesday night, October 21, the ministry said the government would intensify measures to protect confidential information and safeguard online public services against potential cyberattacks.
PHP, which was created in 1994, is used to develop and maintain websites, web applications and digital service platforms. The newly discovered flaws have raised concerns about the security of systems that rely on the technology.
The vulnerabilities were identified after cybersecurity firms used artificial intelligence (AI) tools to uncover weaknesses in PHP’s underlying code. The discoveries have prompted organisations worldwide to assess their systems and apply security fixes to prevent potential exploitation.
The PHP Foundation urged organisations using the programming language to install the relevant updates, warning that immediate action was necessary to address the risks. The Ministry of ICT instructed government institutions to establish whether their systems were affected and confirm the appropriate fixes using official PHP guidance and software vendor advisories before deploying updates.
It also called on institutions to review their web application firewalls, access controls and other security measures to minimise exposure while remediation efforts are underway. However, the ministry cautioned that temporary safeguards alone would not be sufficient to address the vulnerabilities.
“Temporary protective measures should not be treated as a substitute for applying the official security updates,” the statement noted.
The government also plans to identify vulnerable systems, strengthen monitoring and work with third parties, including hosting providers and software developers, to ensure the flaws are addressed. The ICT Authority will coordinate technical guidance and support for affected institutions, helping them identify exposed systems, implement corrective measures and monitor compliance.
“All government institutions are required to treat this advisory as urgent and ensure that the necessary technical and administrative measures are undertaken to safeguard Government websites,” the ministry stated.
Institutions have been directed to prioritise remediation based on the level of exposure and the importance of the affected services, with unresolved high-risk vulnerabilities to be escalated through the designated channels.
The flaws, dubbed “PHP2SHELL”, were rated 9.2 out of 10 in severity, highlighting the potential risks posed to vulnerable systems. AI models developed by technology companies, including OpenAI and Google, were used by cybersecurity researchers to help uncover the weaknesses. The discovery has triggered a broader security response as governments and technology companies work to protect servers and online platforms that rely on PHP.
