IN ADVISORY – ZAMBIA ISSUES CYBER WARNINGS AS BRITAIN URGES HOUSEHOLDS TO PREPARE FOR DISRUPTIONS
The Zambia Cyber Security Agency has urged organisations to secure their websites and digital systems against serious security threats, as Britain advises households to prepare for three days of possible disruption to essential services.
ZCSA has flagged critical weaknesses in PHP, software used to run websites, alongside a separate warning involving compromised digital certificates used to establish trust in online connections. Its PHP alert calls for organisations to install security updates urgently.
In Britain, the government’s “Be Ready” campaign encourages households to keep basic supplies, including drinking water and food that does not require refrigeration. The campaign covers disruptions caused by severe weather and other emergencies affecting electricity, water, telephone and internet services. It is preparedness advice, rather than a prediction that a particular emergency will occur.
Reuters reports that the British government cited this week’s PHP security incident, alongside heat, drought and wildfires, as evidence of the importance of being prepared. The software weaknesses prompted organisations internationally to secure affected systems, with some services taken offline.
For Zambia, the immediate technical concern is whether organisations operate vulnerable software or continue trusting compromised digital certificates. The supplied ZCSA advisories do not announce a nationwide internet shutdown or instruct Zambians to stockpile supplies.
PHP, the technology at the centre of one warning, works behind the scenes on websites, processing requests and interacting with databases. The flaws, collectively known as PHP2Shell, can allow attackers to run unauthorised commands on vulnerable servers without first logging in. Successful attacks could expose sensitive information, alter websites or disrupt services.
The PHP development team has released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It warns that temporary protective measures do not provide a complete solution and urges users to update. These are updates for the systems running websites; ordinary visitors cannot install them on behalf of a website operator.
Separately, the ZCSA bulletin supplied with this report warns that weaknesses in eight eMudhra, or emSign, intermediate certificate-authority keys could enable criminals to create fraudulent digital certificates.
A digital certificate helps software verify that it is communicating with the intended website or service. If a vulnerable system accepts a fraudulent certificate, an attacker positioned to intercept its connection could impersonate the genuine service and potentially read or alter information passing through it. Red Hat’s security bulletin independently confirms this risk.
The supplied ZCSA advisory classifies the certificate issue as high severity, but states that no exploitation had been confirmed at the time of publication and that the impact in Zambia remained under assessment.
It advises administrators to update certificate-trust packages and affected software, check equipment that maintains its own certificate lists, and never disable certificate checks. It also directs organisations to replace emSign certificates on their websites before 27 October.
The PHP vulnerabilities and the certificate compromise are separate problems. Repairing one does not automatically resolve the other
For members of the public, the practical implications depend on which services are affected. A compromised or temporarily suspended system could delay access to an online shop, school portal, booking platform or public service. These are possible consequences, not confirmation that any particular Zambian institution has been breached.
A website going offline also does not necessarily mean criminals have taken control. Operators may deliberately suspend access while applying security fixes. Britain’s National Cyber Security Centre advises organisations to consider taking vulnerable systems offline where they cannot protect them promptly.
What this means in everyday terms
1. For someone using a website: The weakness may be in the service’s underlying software, even if you have a strong password. Changing your password alone cannot repair the website’s server.
2. For a business owner: Ask your website developer or hosting provider whether your site uses PHP and whether the relevant security fixes have been installed. Updating the website’s appearance or content is not the same as updating PHP.
3. For an organisation handling customer information: Applying a patch closes the identified weakness, but does not by itself establish whether an attacker accessed the system beforehand. Administrators should also investigate signs of compromise.
3. For certificate security: Think of the problem as a forged identity document that some systems may still accept. Those systems must update their trust information so they reject the compromised credentials. The attack described requires an opportunity to intercept communications; it does not automatically expose everyone’s internet traffic.
4. For household preparedness: Three days is a planning buffer, not a forecast of how long an outage will last. The British advice aims to help households manage temporarily while services recover and emergency workers assist those most in need. .
As practical precautions, users should keep devices and applications updated, avoid bypassing security-certificate warnings, and use established contact channels to verify unexpected requests for passwords, PINs or payments.
The ZCSA bulletin lists incidents@csa.gov.zm for reporting cybersecurity incidents.
