Singapore organisations urged to patch critical PHP vulnerabilities immediately: CSA

The two vulnerabilities could allow attackers to take control of affected web servers without login credentials, potentially exposing data and disrupting services.

Unplugged LAN network cables at a computer server, as cyber agencies warn that websites may be taken offline while PHP prepares a critical fix, in Berlin, Germany, on Oct 21, 2026. (Photo: Reuters/Annegret Hilse)

This audio is generated by an AI tool.

SINGAPORE: Organisations in Singapore have been urged to patch two critical vulnerabilities in PHP, a programming language widely used to power websites and online services, as attackers could exploit affected systems without needing login credentials.

The vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), could potentially allow attackers to take control of web servers, steal data or disrupt services, said Commissioner of Cybersecurity and Cyber Security Agency of Singapore (CSA) chief executive Gwenda Fong in a LinkedIn post on Thursday (Oct 22).

Ms Fong said that the threat was immediate, with working exploits already demonstrated and security patches released on Wednesday.

The priority now is to identify and patch vulnerable systems before attackers can exploit them, she said.

CNA Games Guess Word Crack the word, one row at a time Buzzword Create words using the given letters Mini Sudoku Tiny puzzle, mighty brain teaser Mini Crossword Small grid, big challenge Word Search Spot as many words as you can Show More Show Less PHP is widely used in websites, including those built on platforms such as WordPress, Drupal and Joomla. Ms Fong said that many organisations, particularly small and medium-sized enterprises (SMEs) that rely on external IT vendors or hosting providers, may not realise their systems are affected. According to a CSA security alert issued on Wednesday, the vulnerabilities affect all versions of PHP and could allow attackers to remotely execute code on vulnerable systems without authentication. The agency said there had been reports of widespread exploitation attempts targeting the vulnerabilities, as well as the development of multiple proof-of-concept exploits. The vulnerabilities have also prompted website operators around the world to take precautionary measures, with government websites in Europe and elsewhere going offline on Wednesday. Cloud services firm Cloudflare recorded millions of exploitation attempts after the public disclosure of critical vulnerabilities in the widely used programming language PHP, CEO Matthew Prince said in a post on X late on Wednesday. Developers of PHP on Wednesday released urgent new fixes to vulnerabilities that had been lurking in their software for years until they were uncovered using AI, saying all users were "encouraged to update immediately."

PHP is widely used in websites, including those built on platforms such as WordPress, Drupal and Joomla.

Ms Fong said that many organisations, particularly small and medium-sized enterprises (SMEs) that rely on external IT vendors or hosting providers, may not realise their systems are affected.

According to a CSA security alert issued on Wednesday, the vulnerabilities affect all versions of PHP and could allow attackers to remotely execute code on vulnerable systems without authentication.

The agency said there had been reports of widespread exploitation attempts targeting the vulnerabilities, as well as the development of multiple proof-of-concept exploits.

The vulnerabilities have also prompted website operators around the world to take precautionary measures, with government websites in Europe and elsewhere going offline on Wednesday.

Cloud services firm Cloudflare recorded millions of exploitation attempts after the public disclosure of critical vulnerabilities in the widely used programming language PHP, CEO Matthew Prince said in a post on X late on Wednesday.

Developers of PHP on Wednesday released urgent new fixes to vulnerabilities that had been lurking in their software for years until they were uncovered using AI, saying all users were "encouraged to update immediately."

CSA said it was "working urgently" with government agencies, critical information infrastructure owners, major enterprises and industry partners to accelerate patching.

It is also reaching out through business associations, cybersecurity service providers and technology partners to help smaller organisations address the vulnerabilities.

"My message to every organisation in Singapore is simple: do not wait," said Ms Fong.

She urged organisations operating websites or online services to check whether their systems, including those managed by third-party vendors, use affected versions of PHP.

Affected organisations should immediately apply security patches, prioritising internet-facing systems, and investigate whether their systems may already have been compromised.

Those unsure whether their systems are vulnerable should contact their IT teams, website developers or hosting providers, she added.

"Cybersecurity is a shared responsibility. Acting quickly now can prevent a vulnerability from becoming a serious incident," said Ms Fong.

Get our pick of top stories and thought-provoking articles in your inbox

Stay updated with notifications for breaking news and our best stories

Join our channel for the top reads for the day on your preferred chat app

这两个漏洞可能允许攻击者在没有登录凭据的情况下控制受影响的 Web 服务器，从而可能泄露数据并中断服务。

2026年10月21日，德国柏林，一台计算机服务器上的局域网线缆被拔掉。网络安全机构警告称，在PHP准备关键修复程序期间，网站可能会离线。（图片：路透社/Annegret Hilse）

这段音频是由人工智能工具生成的。

新加坡：新加坡各机构被敦促修复 PHP（一种广泛用于驱动网站和在线服务的编程语言）中的两个严重漏洞，因为攻击者无需登录凭证即可利用受影响的系统。

新加坡网络安全专员兼网络安全局 (CSA) 首席执行官 Gwenda Fong 周四（10 月 22 日）在 LinkedIn 上发帖称，这些漏洞统称为 PHP2Shell（CVE-2026-109618 和 CVE-2026-109619），可能会让攻击者控制 Web 服务器、窃取数据或中断服务。

方女士表示，威胁迫在眉睫，已有漏洞被演示，安全补丁已于周三发布。

她表示，目前的当务之急是在攻击者利用漏洞系统之前，识别并修补这些漏洞系统。

CNA游戏 猜词游戏 逐行破解单词 流行词游戏 用给定的字母组成单词 迷你数独 小谜题，脑力挑战 迷你填字游戏 小方格，大挑战 单词搜索 尽可能多地找出单词 显示更多 显示更少 PHP广泛应用于网站，包括基于WordPress、Drupal和Joomla等平台构建的网站。方女士表示，许多机构，特别是依赖外部IT供应商或托管服务提供商的中小型企业(SME)，可能并未意识到他们的系统受到影响。根据加拿大安全局(CSA)周三发布的安全警报，这些漏洞影响所有版本的PHP，并可能允许攻击者在未经身份验证的情况下远程执行易受攻击系统上的代码。该机构表示，已有报告称针对这些漏洞的广泛攻击尝试，以及多个概念验证漏洞的开发。这些漏洞也促使世界各地的网站运营商采取预防措施，欧洲和其他地区的政府网站已于周三下线。云服务公司 Cloudflare 的首席执行官 Matthew Prince 周三晚间在 X 平台上发文称，在广泛使用的编程语言 PHP 的严重漏洞被公开披露后，该公司记录了数百万次攻击尝试。PHP 的开发人员周三发布了紧急修复程序，以修复多年来一直潜伏在软件中的漏洞，这些漏洞直到使用人工智能技术才被发现。开发人员表示，鼓励所有用户“立即更新”。

PHP广泛应用于网站，包括基于WordPress、Drupal和Joomla等平台构建的网站。

方女士表示，许多机构，特别是依赖外部 IT 供应商或托管服务提供商的中小型企业 (SME)，可能没有意识到他们的系统受到了影响。

根据加拿大安全管理局 (CSA) 周三发布的安全警报，这些漏洞影响所有版本的 PHP，并可能允许攻击者在未经身份验证的情况下远程在易受攻击的系统上执行代码。

该机构表示，有报告称，针对这些漏洞的广泛利用企图已经发生，并且还开发了多个概念验证漏洞利用程序。

这些漏洞也促使世界各地的网站运营商采取预防措施，欧洲和其他地区的政府网站于周三下线。

云服务公司 Cloudflare 的首席执行官 Matthew Prince 周三晚些时候在 X 上发帖称，在广泛使用的编程语言 PHP 中的关键漏洞被公开披露后，该公司记录了数百万次攻击尝试。

PHP 开发人员周三发布了紧急新修复程序，以修复多年来一直潜伏在其软件中的漏洞，这些漏洞直到使用人工智能才被发现。开发人员表示，鼓励所有用户“立即更新”。

CSA表示，它正在与政府机构、关键信息基础设施所有者、主要企业和行业合作伙伴“紧急合作”，以加快补丁更新。

它还通过商业协会、网络安全服务提供商和技术合作伙伴来帮助小型组织解决这些漏洞。

方女士说：“我对新加坡所有机构的信息很简单：不要等待。”

她敦促运营网站或在线服务的组织检查其系统（包括由第三方供应商管理的系统）是否使用了受影响的 PHP 版本。

受影响的组织应立即应用安全补丁，优先处理面向互联网的系统，并调查其系统是否可能已被入侵。

她补充说，如果不确定自己的系统是否存在漏洞，应该联系公司的 IT 团队、网站开发人员或托管服务提供商。

“网络安全是每个人的责任。现在迅速采取行动可以防止漏洞演变成严重事件，”方女士说。

订阅我们的邮件，即可获取精选热点新闻和引人深思的文章。

订阅通知，第一时间获取突发新闻和精彩报道。

加入我们的频道，即可在您常用的聊天应用上获取当日热门文章。