About us

The mission of the National Cyber Security Authority (NCSA) is to build skills and capabilities necessary to secure Rwanda’s cyberspace in order to sustain economic and social development. Specifically, NCSA oversees the following areas

Cyber Defense and Resilience

24/7 Prevention, Threat monitoring and Incident Response

Cybersecurity Standards

Develop cybersecurity policies and strategies to ensure cyber resilience

Data Protection and Privacy

Enforce Rwanda’s Law on Personal Data Protection and Privacy

Cybersecurity coordination

We collaborate with partners to ensure a secure cyberspace

Security Alert: Critical Remote Code Execution Vulnerabilities in PHP

21 October 2026

PHP has released security updates addressing two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities are rated Critical, with a CVSS v4.0 score of 9.2. They could allow unauthenticated remote attackers to execute malicious code on affected servers.

Affected Systems

The following system versions are affected:

PHP 8.5: versions before 8.5.12
PHP 8.4: versions before 8.4.27
PHP 8.3: versions before 8.3.36
PHP 8.2: versions before 8.2.35
PHP 8.1 and earlier: These versions are also affected.

Security Risks

The identified critical vulnerabilities could allow attackers to execute malicious code on affected servers without authentication or access sensitive information, including passwords and other credentials. Successful exploitation could compromise affected servers, websites, and web applications.

Recommended Actions

The National Cyber Security Authority (NCSA) recommends users and system administrators to:

1. Update PHP to a fixed version as soon as possible to address the identified critical vulnerabilities and protect affected servers from potential exploitation.

The recommended software versions to upgrade to are as follows:

PHP 8.5: Upgrade to version 8.5.12 or above
PHP 8.4: Upgrade to version 8.4.27 or above
PHP 8.3: Upgrade to version 8.3.36 or above
PHP 8.2: Upgrade to version 8.2.35 or above
PHP 8.1 and earlier: Upgrade to a supported version or check with the relevant vendor for available security fixes.

2. Before performing any update tasks, ensure that you have a backup of your data.
For further information and support, please contact the National Cyber Security Authority (NCSA) by emailto rwcsirt@ncsa.gov.rw or call us on 9009
References