Singapore firms urged to act urgently over critical PHP vulnerabilities

Critical vulnerabilities have been found in the widely-used PHP programming language, with its developers releasing urgent security patches on Oct 21.

The vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), have reportedly been lurking in the programming language for years before they were uncovered using artificial intelligence, according to the software's developers.

These could allow attackers to exploit affected systems without needing login credentials, potentially taking control of web servers, stealing data or disrupting services.

PHP is a programming language used to power websites and online services. It is widely used, including in websites built on platforms such as WordPress, Drupal and Joomla.

When a visitor loads a page, a server running PHP assembles the content and sends it to the browser. It is free, open-source software maintained by volunteers.

With tech firms warning that some hackers were already exploiting the flaws and government agencies across Europe taking sites offline as a precaution, the Cyber Security Agency of Singapore (CSA) on Thursday (Oct 22) issued an urgent advisory.

In a LinkedIn post, CSA chief executive and Singapore Commissioner of Cybersecurity Gwenda Fong described the vulnerabilities as "particularly concerning".

"The threat is immediate. Working exploits have been demonstrated, and security patches were released on Oct 21. The priority now is to identify and patch vulnerable systems before attackers can exploit them," she wrote.

CSA is also working with Singapore government agencies, critical information infrastructure owners, major enterprises and industry partners to accelerate patching.

The agency is also reaching out to business associations, cybersecurity service providers and technology partners to help smaller organisations take action.

Many organisations, especially small and medium enterprises that rely on external IT vendors and hosting providers, may not realise that their systems are affected, the commissioner noted.

Organisations that operate websites or online services should:

Check whether systems, including those managed by third-party vendors, use affected versions of PHP.

Patch immediately, prioritising internet-facing systems.

Investigate whether there are signs that systems may already have been compromised.

Those who are unsure whether their organisation is affected should contact their in-house IT team, website developer or hosting provider immediately.

"Cybersecurity is a shared responsibility. Acting quickly now can prevent a vulnerability from becoming a serious incident," Fong emphasised.

广泛使用的 PHP 编程语言被发现存在严重漏洞，其开发人员已于 10 月 21 日发布紧急安全补丁。

据软件开发人员称，这些漏洞统称为 PHP2Shell（CVE-2026-109618 和 CVE-2026-109619），多年来一直潜伏在该编程语言中，直到使用人工智能才被发现。

这些漏洞可能使攻击者无需登录凭证即可利用受影响的系统，从而有可能控制网络服务器、窃取数据或中断服务。

PHP 是一种用于构建网站和在线服务的编程语言。它被广泛使用，包括在 WordPress、Drupal 和 Joomla 等平台上构建的网站。

当访客加载页面时，运行 PHP 的服务器会组装内容并将其发送到浏览器。PHP 是由志愿者维护的免费开源软件。

由于科技公司警告称一些黑客已经开始利用这些漏洞，并且欧洲各地的政府机构出于预防措施将网站下线，新加坡网络安全局 (CSA) 于周四（10 月 22 日）发布了一项紧急公告。

CSA 首席执行官兼新加坡网络安全专员 Gwenda Fong 在 LinkedIn 上发帖称，这些漏洞“尤其令人担忧”。

她写道：“威胁迫在眉睫。攻击者已经演示了有效的攻击手段，安全补丁也已于10月21日发布。现在的当务之急是在攻击者利用漏洞之前，识别并修复这些漏洞系统。”

CSA 还与新加坡政府机构、关键信息基础设施所有者、主要企业和行业合作伙伴合作，加快补丁更新速度。

该机构还与商业协会、网络安全服务提供商和技术合作伙伴联系，以帮助规模较小的组织采取行动。

专员指出，许多组织，特别是依赖外部 IT 供应商和托管服务提供商的中小型企业，可能没有意识到他们的系统受到了影响。

运营网站或在线服务的机构应该：

检查系统（包括第三方供应商管理的系统）是否使用受影响的 PHP 版本。

立即打补丁，优先处理面向互联网的系统。

调查是否存在系统已被入侵的迹象。

如果不确定自己的组织是否受到影响，应立即联系其内部 IT 团队、网站开发人员或托管服务提供商。

“网络安全是每个人的责任。现在迅速采取行动可以防止漏洞演变成严重事件，”方强调说。