Your website could be at risk: CSA, NITA issue urgent cybersecurity alert

The Cyber Security Authority (CSA) and the National Information Technology Agency (NITA) have issued an urgent cybersecurity alert to government institutions, warning of vulnerabilities in the PHP programming language that could allow attackers to take control of affected servers. These vulnerabilities, collectively known as "PHP2Shell" and identified as CVE-2026-109618 and CVE-2026-109619, could expose sensitive information, disrupt online services, and provide a pathway for further cyber attacks.

The agencies have directed all government institutions, businesses, website owners, and hosting providers to address these issues within seven days and report the necessary actions to both authorities. Affected organizations are advised to update to the correct supported release or a vendor package containing the necessary fixes, as updating website themes or plugins alone will not resolve the vulnerabilities.

System administrators are recommended to inspect server logs and monitor for unusual activities that may indicate a compromised system. The CSA and NITA will provide technical support for digital assets and services in government institutions, while the CSA will oversee cybersecurity incident reporting and response. The public is advised against downloading purported PHP security updates or sharing sensitive information, with suspected incidents to be reported to the CSA via phone, SMS, or email.