The Cybersecurity Working Group of the CIO-CXO Digital Leadership Forum has issued a security advisory (Ref. CIO-CXO/CSWG/SA/2026/001) on two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2).

PHP, the programming language behind most websites, including WordPress, Joomla, Drupal, Magento, and Laravel, is not immune to attack. With a single request, an attacker with no password can take over a web server and steal passwords and keys.

Our Cybersecurity Working Group identified an attack that began on 17 October, before a fix was released on 21 October.

If your organization has a website, customer portal, online shop or payment page runs on PHP, please take action with immediate effect:

  1. Ask your web developer, hosting provider or IT team if it been updated to a fixed version (8.5.12, 8.4.27, 8.3.36 or 8.2.35).
  2. Run a quick website safety self-check with the tools given below (these tools only read the PHP version and do not attack your site): SOCRadar: https://socradar.io/free-tools/php2shell-checker or Brandefense: https://atlas.brandefense.io/php-vulnerability-check. An "inconclusive" result does not mean you are safe. Ask your provider to check for signs of intrusion since 17 October.
  3. You can report incidents to CERT.UG (https://www.cert.ug/form/reporter-s-contact-information), UCC (https://www.ucc.co.ug/contact-us/), or the CIO-CXO Digital Leadership Forum (secretariat@cio-cxo.africa or call 0394 538 616). Guidance will be provided.

Please read our full advisory and share it with your leadership and your IT providers. DOWNLOAD HERE.