On October 22 at 17:19, Digital Business published an official response from National Information Technologies JSC (NIT) regarding the impact of recent critical PHP vulnerabilities on Kazakhstan’s e-government portal eGov.kz. According to the operator, the discovered vulnerabilities do not affect the public infrastructure.
What the Operator Reported on the Portal
In its official response, NIT emphasized that the security flaws cited in the media inquiry do not compromise eGov.kz. At the time of the statement, the portal and its key infrastructure components continued operating under normal conditions without disruptions to public services.
An in-depth review of Kazakhstan’s public service digitization is available in The State in Your Pocket: How eGov Transformed Kazakhstan — and Why the Next Step Is Harder Than the First.
Which Deployments Were Affected
The inquiry followed an urgent security advisory released on October 21 by the PHP project team (php.net), delivering versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases address CVE-2026-109618 and CVE-2026-109619, which could allow remote code execution without authentication on vulnerable web-facing systems. The maintainers urged server operators to upgrade immediately as temporary workarounds do not guarantee complete protection.
Further technical details on the upstream security response can be found in our report: PHP Developers Release Critical Security Fixes Urging Server Administrators to Upgrade.
What This Means for Readers
- According to the official position of NIT JSC, eGov.kz infrastructure remains unaffected and public administrative services continue to operate normally.
- Independent website owners and administrators running PHP workloads should inspect their hosting setups and apply the upstream patches promptly.
Where to Check the PHP Version
The WordPress team clarified (wordpress.org) that the issue resides strictly in the underlying PHP server runtime rather than the content management system itself. Site administrators can inspect their runtime configuration via their hosting control panel or through the Site Health screen in WordPress under the Tools menu.
