Singapore organisations urged to patch critical PHP flaws immediately amid cyberattack threat
The two vulnerabilities could allow attackers to take control of affected web servers without login credentials, potentially exposing data and disrupting services.
· CNA · JoinRead a summary of this article on FAST.
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST Tap here to return to FAST
FAST
SINGAPORE: Organisations in Singapore have been urged to immediately fix two critical security flaws in a widely used programming language, amid reports of widespread attempts by hackers to exploit the vulnerabilities.
The flaws in PHP, which powers many websites and online services, could allow attackers to take control of web servers, steal data or disrupt services without needing login credentials, said Singapore's Commissioner of Cybersecurity Gwenda Fong on Thursday (Oct 22).
"The threat is immediate," Ms Fong, who is also chief executive of the Cyber Security Agency of Singapore (CSA), said in a LinkedIn post.
Working exploits have already been demonstrated, and security patches were released on Wednesday, she added.
CNA Games
Guess Word
Crack the word, one row at a time
Buzzword
Create words using the given letters
Mini Sudoku
Tiny puzzle, mighty brain teaser
Mini Crossword
Small grid, big challenge
Word Search
Spot as many words as you can
Show More
Show Less
The vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), affect all versions of PHP, according to a CSA security alert issued on Wednesday.
The agency said there had been reports of widespread exploitation attempts, as well as the development of multiple proof-of-concept exploits.
Cloud services firm Cloudflare recorded millions of attempts to exploit the vulnerabilities following their public disclosure, its chief executive Matthew Prince said in a post on X late on Wednesday.
The flaws have also prompted website operators around the world to take precautionary measures, with government websites in Europe and elsewhere going offline on Wednesday.
PHP developers released urgent security fixes on Wednesday for vulnerabilities that had gone undetected for years before being uncovered using artificial intelligence, urging users to update immediately.
Ms Fong warned that many organisations, particularly small and medium-sized enterprises (SMEs) that rely on external IT vendors or hosting providers, may not realise their systems are vulnerable.
PHP is widely used in websites, including those built on platforms such as WordPress, Drupal and Joomla.
"My message to every organisation in Singapore is simple: do not wait," she said.
Organisations operating websites or online services should check whether their systems use affected versions of PHP, including those managed by third-party vendors.
They should apply security patches immediately, prioritising systems accessible from the internet, and investigate whether their systems may already have been compromised, Ms Fong added.
Those unsure whether they are affected should contact their IT teams, website developers or hosting providers.
CSA said it was working urgently with government agencies, critical information infrastructure owners, major enterprises and industry partners to accelerate patching.
It is also reaching out through business associations, cybersecurity service providers and technology partners to help smaller organisations address the vulnerabilities.
"The priority now is to identify and patch vulnerable systems before attackers can exploit them," Ms Fong said.
"Cybersecurity is a shared responsibility. Acting quickly now can prevent a vulnerability from becoming a serious incident."
Sign up for our newsletters
Get our pick of top stories and thought-provoking articles in your inbox
Get the CNA app
Stay updated with notifications for breaking news and our best stories
Get WhatsApp alerts
Join our channel for the top reads for the day on your preferred chat app