The National Information Technology Development Agency (NITDA) has warned Nigerians about two critical PHP security vulnerabilities that could allow attackers to take control of web servers without authentication.
In a security advisory issued on Thursday, the agency’s Computer Emergency Readiness and Response Team (CERRT.NG) identified the flaws as CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.
The vulnerabilities affect a wide range of PHP versions, reportedly dating back to version 5.4, putting websites, applications and servers running vulnerable software at risk.
The warning comes amid reports of attempts to exploit the flaws, prompting calls for organisations to secure their systems and apply the necessary updates.
How PHP2Shell could expose websites
NITDA warned that successful exploitation could allow attackers to execute malicious code remotely, gain extensive access to affected servers and expose sensitive information stored in memory.
“A successful attack gives full server access to execute remote code without authentication, and provide full memory access,” NITDA said.
The agency cautioned that the vulnerabilities could result in stolen data, defaced websites or the complete takeover of affected systems.
Passwords and application programming interface (API) keys held in memory could also be exposed, potentially compromising connected services and other systems.
WordPress, Drupal and Joomla among potentially affected platforms
According to NITDA, potentially affected systems include PHP-powered websites and applications built with WordPress, Drupal, Joomla and Laravel.
Vendor products that bundle PHP may also be vulnerable, meaning organisations must check not only their websites but also the software and hosting environments supporting them.
Internet-facing systems should receive priority during security checks and updates because they are directly accessible to potential attackers.
NITDA recommends immediate security updates
NITDA advised organisations to update their PHP installations to the fixed versions appropriate for their systems, PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 or PHP 8.2.35.
The agency also urged organisations to confirm that their hosting providers and PHP-based tools are running secure versions and to investigate possible signs of compromise.
“If you cannot update now, take the system offline until it is fixed,” the advisory reads.
Organisations using older PHP releases should consult their software vendors for appropriate security fixes, particularly where their versions no longer receive standard updates.
PHP2Shell compared with Heartbleed
Volker Dusch, a security engineer at the PHP Foundation, described the vulnerabilities as the most serious PHP security issue in more than a decade.
He compared them with Heartbleed, a major security flaw disclosed in 2014 that triggered a worldwide effort to identify and patch vulnerable systems.
Governments and businesses worldwide reportedly shut down websites and online services as they worked to address the PHP2Shell vulnerabilities.
The warning highlights the need for organisations running PHP-based services to identify affected systems, install the appropriate security updates and check for evidence of unauthorised access.
