Uganda Police recorded 412 cybercrime cases in 2025, with losses of about Shs 5.3 billion. Police forensics say many institutions only speak up after serious damage, so the real number is likely higher. Who is breaking into Ugandan websites, how do they get in, and what can you do about it this week?
▶️ Subscribe to Elgon Web Hosting on YouTube for more step-by-step tech tips.
The four suspects
- Automated bots. Programs scan the internet around the clock for outdated software. According to Patchstack, heavily exploited WordPress flaws are attacked a median of about five hours after they are made public.
- Stolen passwords. The Uganda Communications Commission says 713,235 Uganda-linked logins were found compromised in the past 12 months. Reused or shared passwords let attackers simply log in.
- Insiders. Former staff and developers who still have access. Uganda Police forensics call the insider threat “real”.
- Protest groups. Hacktivists usually target government and large organisations with website defacements and traffic floods (DDoS).
How they get in
Verizon’s 2026 Data Breach Investigations Report found that exploiting software vulnerabilities is now the top way in, at 31% of breaches, ahead of stolen credentials at 13%. For WordPress sites, the weak spot is plugins: Patchstack counted 11,334 new WordPress flaws in 2025, 91% of them in plugins, and 46% had no fix available when they were disclosed.
Happening now: php2shell
In October 2026, the US agency CISA warned about two critical PHP flaws, known as “php2shell”, that let attackers run code on a server without a password, and said they are being exploited. CERT.UG issued a notice in Uganda. Website owners can’t fix this themselves: your hosting company has to apply the patch. The patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older should be updated.
Lock your website down in five moves
- Ask your host in writing which PHP version your site runs and whether it is patched against php2shell.
- Delete unused plugins and themes, and keep the rest updated.
- Audit user accounts and remove former staff, interns and developers.
- Give every user a unique password and turn on two-step login.
- Keep backups outside your hosting account, and test that you can restore them.
Already hacked?
Don’t wipe everything straight away. Keep the evidence (logs, suspicious files and screenshots), change every password (hosting, website, email and database), and report the incident to CERT.UG. If money or customer data is involved, report it to the Police as well. If Google has flagged your site as dangerous, see our guide: How to remove Google’s “Dangerous site” warning.
Want help securing your website? Talk to the Elgon Web Hosting team.
Source: Kasirye Labs, “Who’s hacking Ugandan websites and how”, which cites the Uganda Police Annual Crime Report 2025, the Uganda Communications Commission, the Verizon DBIR 2026, Patchstack, CISA and CERT.UG.