Singapore organisations urged to patch critical PHP flaws immediately amid cyberattack threat

The two vulnerabilities could allow attackers to take control of affected web servers without login credentials, potentially exposing data and disrupting services.

Unplugged LAN network cables at a computer server, as cyber agencies warn that websites may be taken offline while PHP prepares a critical fix, in Berlin, Germany, on Oct 21, 2026. (Photo: Reuters/Annegret Hilse)

This audio is generated by an AI tool.

SINGAPORE: Organisations in Singapore have been urged to immediately fix two critical security flaws in a widely used programming language, amid reports of widespread attempts by hackers to exploit the vulnerabilities.

The flaws in PHP, which powers many websites and online services, could allow attackers to take control of web servers, steal data or disrupt services without needing login credentials, said Singapore's Commissioner of Cybersecurity Gwenda Fong on Thursday (Oct 22).

"The threat is immediate," Ms Fong, who is also chief executive of the Cyber Security Agency of Singapore (CSA), said in a LinkedIn post.

Working exploits have already been demonstrated, and security patches were released on Wednesday, she added.

CNA Games Guess Word Crack the word, one row at a time Buzzword Create words using the given letters Mini Sudoku Tiny puzzle, mighty brain teaser Mini Crossword Small grid, big challenge Word Search Spot as many words as you can Show More Show Less The vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), affect all versions of PHP, according to a CSA security alert issued on Wednesday. The agency said there had been reports of widespread exploitation attempts, as well as the development of multiple proof-of-concept exploits. Cloud services firm Cloudflare recorded millions of attempts to exploit the vulnerabilities following their public disclosure, its chief executive Matthew Prince said in a post on X late on Wednesday. The flaws have also prompted website operators around the world to take precautionary measures, with government websites in Europe and elsewhere going offline on Wednesday. PHP developers released urgent security fixes on Wednesday for vulnerabilities that had gone undetected for years before being uncovered using artificial intelligence, urging users to update immediately.

The vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), affect all versions of PHP, according to a CSA security alert issued on Wednesday.

The agency said there had been reports of widespread exploitation attempts, as well as the development of multiple proof-of-concept exploits.

Cloud services firm Cloudflare recorded millions of attempts to exploit the vulnerabilities following their public disclosure, its chief executive Matthew Prince said in a post on X late on Wednesday.

The flaws have also prompted website operators around the world to take precautionary measures, with government websites in Europe and elsewhere going offline on Wednesday.

PHP developers released urgent security fixes on Wednesday for vulnerabilities that had gone undetected for years before being uncovered using artificial intelligence, urging users to update immediately.

Ms Fong warned that many organisations, particularly small and medium-sized enterprises (SMEs) that rely on external IT vendors or hosting providers, may not realise their systems are vulnerable.

PHP is widely used in websites, including those built on platforms such as WordPress, Drupal and Joomla.

"My message to every organisation in Singapore is simple: do not wait," she said.

Organisations operating websites or online services should check whether their systems use affected versions of PHP, including those managed by third-party vendors.

They should apply security patches immediately, prioritising systems accessible from the internet, and investigate whether their systems may already have been compromised, Ms Fong added.

Those unsure whether they are affected should contact their IT teams, website developers or hosting providers.

CSA said it was working urgently with government agencies, critical information infrastructure owners, major enterprises and industry partners to accelerate patching.

It is also reaching out through business associations, cybersecurity service providers and technology partners to help smaller organisations address the vulnerabilities.

"The priority now is to identify and patch vulnerable systems before attackers can exploit them," Ms Fong said.

"Cybersecurity is a shared responsibility. Acting quickly now can prevent a vulnerability from becoming a serious incident."

Get our pick of top stories and thought-provoking articles in your inbox

Stay updated with notifications for breaking news and our best stories

Join our channel for the top reads for the day on your preferred chat app

这两个漏洞可能允许攻击者在没有登录凭据的情况下控制受影响的 Web 服务器，从而可能泄露数据并中断服务。

2026年10月21日，德国柏林，一台计算机服务器上的局域网线缆被拔掉。网络安全机构警告称，在PHP准备关键修复程序期间，网站可能会离线。（图片：路透社/Annegret Hilse）

这段音频是由人工智能工具生成的。

新加坡：有报道称，黑客正试图利用一种广泛使用的编程语言中的两个严重安全漏洞进行大规模攻击，新加坡各组织已被敦促立即修复这些漏洞。

新加坡网络安全专员方文达（Gwenda Fong）周四（10月22日）表示，为许多网站和在线服务提供支持的 PHP 存在缺陷，攻击者可能无需登录凭证即可控制网络服务器、窃取数据或中断服务。

“威胁迫在眉睫，”同时也是新加坡网络安全局 (CSA) 首席执行官的方女士在 LinkedIn 上发帖称。

她补充说，漏洞已被证实可利用，安全补丁已于周三发布。

CNA Games 猜词游戏 逐行破解单词 流行词游戏 使用给定字母创建单词 迷你数独 小谜题，脑力挑战 迷你填字游戏 小方格，大挑战 单词搜索 尽可能多地找出单词 显示更多 显示更少 根据加拿大安全局 (CSA) 周三发布的安全警报，这些漏洞统称为 PHP2Shell（CVE-2026-109618 和 CVE-2026-109619），影响所有版本的 PHP。该机构表示，已收到大量利用这些漏洞的报告，并且开发了多个概念验证漏洞利用程序。云服务公司 Cloudflare 的首席执行官 Matthew Prince 周三晚些时候在 X 上发帖称，在这些漏洞公开披露后，该公司记录了数百万次利用这些漏洞的尝试。这些漏洞也促使世界各地的网站运营商采取预防措施，欧洲和其他地区的政府网站周三都已下线。 PHP 开发人员周三发布了紧急安全修复程序，以修复多年来未被发现的漏洞，这些漏洞是通过人工智能发现的，他们敦促用户立即更新。

根据加拿大安全局 (CSA) 周三发布的安全警报，这些漏洞统称为 PHP2Shell（CVE-2026-109618 和 CVE-2026-109619），会影响所有版本的 PHP。

该机构表示，有报告称存在广泛的利用尝试，以及开发了多个概念验证漏洞利用程序。

云服务公司 Cloudflare 的首席执行官 Matthew Prince 周三晚些时候在 X 上发帖称，在这些漏洞被公开披露后，该公司记录了数百万次利用这些漏洞的尝试。

这些漏洞也促使世界各地的网站运营商采取预防措施，欧洲和其他地区的政府网站于周三下线。

PHP 开发人员周三发布了紧急安全修复程序，以修复多年来未被发现的漏洞，这些漏洞是通过人工智能发现的，他们敦促用户立即更新。

方女士警告说，许多机构，特别是依赖外部 IT 供应商或托管服务提供商的中小型企业 (SME)，可能没有意识到他们的系统存在漏洞。

PHP广泛应用于网站，包括基于WordPress、Drupal和Joomla等平台构建的网站。

“我想对新加坡的每个组织传达的信息很简单：不要等待，”她说。

运营网站或在线服务的组织应检查其系统是否使用受影响的 PHP 版本，包括第三方供应商管理的版本。

方女士补充说，他们应该立即应用安全补丁，优先考虑可从互联网访问的系统，并调查他们的系统是否可能已被入侵。

不确定自己是否受到影响的用户应联系其 IT 团队、网站开发人员或主机托管服务提供商。

CSA表示，正在与政府机构、关键信息基础设施所有者、主要企业和行业合作伙伴紧急合作，加快补丁更新。

它还通过商业协会、网络安全服务提供商和技术合作伙伴来帮助小型组织解决这些漏洞。

方女士表示：“现在的当务之急是在攻击者利用漏洞之前，识别并修补存在漏洞的系统。”

“网络安全是每个人的责任。现在迅速采取行动可以防止漏洞演变成严重事件。”

订阅我们的邮件，即可获取精选热点新闻和引人深思的文章。

订阅通知，第一时间获取突发新闻和精彩报道。

加入我们的频道，即可在您常用的聊天应用上获取当日热门文章。