By Allan Juma, Lead Cybersecurity Engineer at ESET
Many Kenyan websites, shops and portals run on PHP, so a new emergency fix matters to a lot of businesses. On 21 October, the PHP project released fixes for two critical flaws, now known as PHP2Shell. The flaws could let an attacker run code on a vulnerable server without logging in, and PHP rated each one 9.2 on the CVSS v4 scale. The PHP2Shell patch is now available, and a few clear steps can keep organisations safe.
Why the PHP2Shell Patch Happens on The Server
The weakness sits in the PHP runtime, so usual website housekeeping will not close it, and the PHP2Shell patch must be applied on the server itself. Companies on PHP 8.1 or older face a bigger task, because the PHP project no longer releases updates for those versions. They can ask their distribution vendors or long-term support providers for a backported fix, or move to a supported release. PHP has also published minimal source backports for versions 7.4, 8.0 and 8.1, which gives older systems a way forward.
Four Simple Steps to Start Today
First, list where PHP runs, including portals, websites and any third-party products that bundle it. Put internet-facing systems first for the PHP2Shell patch, because attackers can reach them most easily. Ask hosting providers, developers and managed service providers to confirm in writing which of your services are affected. Patching alone does not show whether a server was already compromised, so watch your logs and use suspicious findings to start your incident-response process.
The timing matters, because Kenya’s KE-CIRT/CC recorded about 17.4 million web application attack attempts on critical information infrastructure in April to June 2026. That report, which shows a 43.68% rise on the previous quarter, does not link those attempts to PHP2Shell. PHP also warned on 23 October of a further issue, CVE-2026-115560, with a fix planned in its next regular bugfix release. If the PHP2Shell patch cannot go in quickly, isolate internet-facing applications until it can, and keep watching for odd activity.
