According to the Cyber Security Authority (CSA) and the National Information Technology Agency (NITA), government institutions have been ordered to patch two critical PHP vulnerabilities within seven days. The flaws, identified as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, could allow unauthorized access to servers without requiring a username or password. The agencies warned that successful exploitation could lead to the exposure of sensitive information and the disruption of public digital services. Heads of institutions are required to ensure ICT teams and service providers secure affected systems and report remedial actions to the agencies. The directive also applies to businesses, hosting providers, and operators of Critical Information Infrastructure. The CSA and NITA advised that organizations should install fixed versions of the PHP software or take vulnerable systems offline. Furthermore, the agencies cautioned the public against fraudulent messages claiming to offer security updates and provided contact channels for reporting potential cybersecurity incidents.