Three stories for organisations in Kenya and East Africa this week, what each means in practice, and what to do about it. One comes from the national threat report, one from the Central Bank of Kenya's draft rules for banks, and one is a patching job that cannot wait. We also looked for a critical-infrastructure incident from the past week that we could confirm from a primary source. We did not find one, so we have not stretched a weaker story to fill the slot.
- The national threat report: more attacks, and one line about a government breach
- The CBK's draft risk rules put cyber and third-party risk in writing
- PHP2Shell: two critical PHP flaws, patched on 21 October
Kenya · National threat picture
The national threat report: more attacks, and one line about a government breach
The Communications Authority of Kenya has posted the National KE-CIRT/CC cybersecurity report for July to September 2026 (43rd edition, on its website in October 2026). It counts about 2.7 billion threat events detected over the quarter, up 14.45% on April to June. Within that, brute-force events rose 85.41% to about 44.9 million, and web application attacks rose 57.62% to about 27.4 million. Malware events were about 70.8 million, up 20.01%. DDoS events fell 97.18% to 23,124. The report links brute-force compromises to vulnerable databases, weak authentication and insecure RDP.
The report also summarises the 56th National Cybersecurity Committee meeting, held on 23 September 2026. It says the e-government sector stressed stronger protection of information assets following a breach earlier in the year, and that the sector was working on audit requirements raised by the Office of the Data Protection Commissioner (ODPC). That is all it says. It does not name the agency, the method, whether data was taken, or how many people were affected. The totals are detected events, not confirmed breaches, so they show direction rather than the number of successful attacks. General information, not legal advice.
Why it matters here: The fastest-growing categories are the ones that exploit basics: guessable logins, exposed remote access, unpatched web applications. RETACH's reading: these are problems an organisation of any size can check this week. The breach line also shows that an ODPC audit can follow an incident, so the paperwork needs to be in order before one.
What to do this week
- List what faces the internetRemote desktop, VPN, admin panels, databases and web applications. If nobody can list them, an attacker can find them first.
- Close RDP and database exposurePut remote desktop and databases behind a VPN or gateway, not the open internet.
- Turn on multi-factor sign-inStart with email, remote access and admin accounts, and remove default and shared passwords.
- Watch for repeated failed loginsMake sure someone sees a burst of failures on a key system and knows what to do next.
- Check your audit fileKeep the data map, processor agreements and breach procedure where you can produce them quickly.
National detections are rising, led by brute-force and web application attacks.
Weak or reused logins, remote access left open, and web applications that are not kept up to date.
A Health Scan finds, scores and documents these gaps. Managed Security Services adds threat monitoring and incident response on a retainer.
Banking · Regulation
The CBK's draft risk rules put cyber and third-party risk in writing
On 10 September 2026 the Central Bank of Kenya invited public comments on a package of draft revised Prudential Guidelines, Risk Management Guidelines, Guidance Notes and a framework for domestic systemically important banks. Comments close on 7 November 2026 and go by email to fin@centralbank.go.ke, using the CBK's template. This is a draft for consultation, not a final rule.
The draft Risk Management Guidelines apply to institutions licensed under the Banking Act. They list information and communication technology, cybersecurity and third-party risk among the risk categories an institution must manage. On controls, they describe threat and vulnerability assessments, access controls, network security, data protection and real-time monitoring, reviewed regularly with AI-driven attacks and ransomware in mind. They also describe risk-based due diligence and ongoing monitoring of service providers, tested business continuity, disaster recovery and incident response, and internal audit coverage of cybersecurity and third-party arrangements. RETACH read the draft Risk Management Guidelines in part, so check the full text. This brief does not cover the other documents in the package, and the draft's scope is institutions licensed under the Banking Act, so SACCOs fall outside it. General information, not legal advice.
Why it matters here: RETACH's reading: banks will have to show evidence for service-provider oversight and tested incident response, and they will pass those expectations to the vendors, fintechs and outsourced IT teams they rely on. If you supply or support a bank, expect more questions about how you control access and test your response.
What to do this week
- Decide whether to commentIf you are a bank, or serve one, read the draft and send comments before 7 November.
- Map your service providersList who holds your data or runs your systems, what they can reach, and what the contract says about incidents.
- Find the last real incident testIf you cannot name the date of your last tested response plan, schedule one.
- Check who reviews cyber riskConfirm that someone independent of IT looks at it and reports to the board.
The banking regulator is drafting written expectations on cyber, ICT and third-party risk.
Gaps in vendor oversight, untested response plans and thin board reporting.
Governance, Risk & Compliance work builds the register, policies and evidence. A Digital Resilience Assessment shows where you stand. A Virtual CISO can lead the programme if you have no one in-house.
Practical takeaway · Patching
PHP2Shell: two critical PHP flaws, patched on 21 October
On 21 October 2026 the PHP project published a security advisory for two remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. Its pre-release notice rated both 9.2 on CVSS v4.0. Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The advisory covers PHP web installs in general and says the risk is highest with Apache mod_php. For PHP 8.1 and older, the project published only source backports, and says distributions and long-term-support vendors may offer their own patches. Its interim settings reduce exposure but do not make a system safe. It does not list affected version ranges.
The US National Security Agency issued its own advisory the same day. It tells organisations to inventory systems that rely on PHP, patch promptly, keep logs, replace end-of-life PHP, and take a system offline if it cannot be updated. The Hacker News reported on 27 October that CISA has added both flaws to its Known Exploited Vulnerabilities catalogue, and that a researcher confirmed code execution against a honeypot on 24 October, in a configuration he described as favourable to the attack. RETACH could not load CISA's own page, so check the catalogue yourself. PHP 8.2 reaches end of life on 31 December 2026.
Why it matters here: PHP is widely used for websites, including many content management systems and custom portals built years ago by an agency that may no longer be involved. RETACH's reading: the hard part is rarely the patch. It is knowing which of your sites run PHP, who hosts them and who is responsible for updating them.
What to do this week
- Inventory your PHP sitesList every website, portal and web application, who hosts it and which PHP version it runs.
- Ask your host or developer in writingAsk whether the fixed version is installed, and get the answer on the record.
- Handle PHP 8.1 and olderAsk your vendor whether they provide a backport, and plan a move to a supported version.
- If you cannot patch yetApply the PHP advisory's interim settings, and consider taking non-essential sites offline, as the NSA advises.
- Review the logsLook at web server and PHP error logs since 21 October for unexplained crashes, restarts or unusual requests, and treat anything odd as a possible incident.
Two critical PHP flaws have fixes, and a government agency is urging prompt patching.
Websites and portals with no named owner, unknown PHP versions and unsupported software.
A Health Scan finds, scores and documents what is exposed. Managed Security Services covers monitoring and incident response. SME Security fits smaller teams without a dedicated IT function.
How RETACH works on this
RETACH works in a loop: Assess, Quantify, Remediate, then repeat. We call it the AQR Cycle. A Risk Delta is the change in an organisation's measured risk position before and after a S.I.N.S. Intervention™. It is how a board can see that the fixes above made a difference, rather than taking it on trust.
See where your organisation stands
Start with a free S.I.N.S. Score, or ask for a quote for a Health Scan.
Sources
- Communications Authority of Kenya, National KE-CIRT/CC, Cybersecurity Report, July to September 2026, 43rd edition (posted October 2026; the PDF carries no print date).
- Central Bank of Kenya, Draft CBK Prudential Guidelines, Risk Management Guidelines, Guidance Notes and Framework for Domestic Systemically Important Banks (10 September 2026), and the Draft Risk Management Guidelines 2026.
- PHP project, Security advisory: critical remote code execution vulnerabilities (21 October 2026, under the 2026 news archive).
- US National Security Agency, NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities (21 October 2026).
- The Hacker News, CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution (27 October 2026), for the reported CISA listing and honeypot test.
RETACH summarises these sources in its own words. Figures belong to the publishers and have not been independently verified by RETACH.