MALAWI COMMUNICATIONS REGULATORY AUTHORITY
PUBLIC ANNOUNCEMENT
Malawi CERT Warns of Critical Security Vulnerabilities Affecting PHP
22nd October 2026
The Malawi Communications Regulatory Authority (MACRA), through the Malawi Computer Emergency Response Team (Malawi CERT), is alerting the public to critical security weaknesses affecting PHP, a technology widely used to power websites, web applications and other online services.
The vulnerabilities have been identified as CVE-2026-109618 and CVE-2026-109619. If left unaddressed, these weaknesses could allow cybercriminals to take advantage of affected systems and run harmful code without needing a username or password. This could put websites, online services and sensitive information at risk.
Malawi CERT is urging businesses, government institutions, website owners, web hosting providers and Internet Service Providers (ISPs) to take immediate steps to protect systems running affected versions of PHP.
What You Should Do
Malawi CERT advises all website owners and organisations to:
- Update PHP immediately: Ensure that the software running on your website is updated to a safe version that fixes these security weaknesses.
- Check your website: Contact your IT team or website provider to confirm whether your website uses an affected version of PHP.
- Contact your hosting provider: If another company manages your website, ask them to confirm that the necessary security updates have been installed.
- Protect systems that cannot be updated immediately: Temporarily restrict public access to affected systems until the necessary updates have been applied.
- Check for unusual activity: Look out for unexpected changes to your website or other suspicious activity that could indicate an attempted or successful attack.
Reporting and Assistance
Members of the public and organisations requiring assistance or wishing to report a suspected cybersecurity incident can contact Malawi CERT through the following official channels:
Malawi CERT encourages all website owners and organisations to act promptly to address these security weaknesses and help protect Malawi's online services and digital environment.
