The Cyber Security Authority (CSA) and the National Information Technology Agency (NITA) have given government agencies seven days to fix critical security flaws that could allow hackers to take control of their servers without a username or password.

In a statement issued on October 22, 2026, the two agencies directed all government institutions to address the vulnerabilities and report the corrective measures taken to them within the deadline.

Over $675 million recovered in massive cybercrime crackdown - FBI

“All government institutions must act within the next seven (7) days and report remedial actions taken to the CSA and NITA,” it directed in a joint statement.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are known as “PHP2Shell” and affect PHP, a programming language widely used to run websites and online services.

According to the agencies, successful attacks could expose sensitive information, disrupt online services and allow hackers to launch further attacks on an organisation’s network.

The alert covers government institutions, businesses, website owners, hosting providers and operators of Critical Information Infrastructure in Ghana.

The PHP Project has released security fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 to address the vulnerabilities.

The CSA and NITA have urged affected organisations to install the appropriate fixed versions, a later supported release or a vendor package confirmed to contain the fixes.

They warned that updating website themes or plugins alone would not resolve the problem.

“Updating website themes or plugins alone does not resolve vulnerabilities in the underlying PHP software,” the agencies stated.

Organisations have also been asked to check all their websites, applications and servers that use PHP, including those managed by external service providers.

Ghana’s cyber incidents surpass 2025 total with 4,938 cases in nine months

They have also tasked heads of government institutions with ensuring that their information technology teams and service providers act within the seven-day deadline.

Read the full statement below:





MAG/VPO

Inside Ghana’s Abandoned Engineering Powerhouse: What Went Wrong?