No evidence PHP flaws exploited in government, critical infrastructure systems: Tan Kiat How

Organisations should continue to monitor their systems for signs of compromise, says the Senior Minister of State for Health.

FILE PHOTO: A man holds a laptop computer as cyber code is projected on him in this illustration picture taken on May 13, 2017. REUTERS/Kacper Pempel

This audio is generated by an AI tool.

SINGAPORE: There is no evidence that PHP vulnerabilities were exploited in government systems or Singapore's critical information infrastructure (CII), said Senior Minister of State for Health Tan Kiat How in parliament on Wednesday (Nov 4).

This follows the Oct 21 disclosure of critical flaws in PHP, a programming language that runs about 70 per cent of the world's websites, leading Singapore authorities to urge organisations to patch gaps immediately amid cyberattack threat .

Following the disclosure, the Government Technology Agency (GovTech) and Cyber Security Agency of Singapore (CSA) worked with government agencies and CII owners to identify and secure affected systems, said Mr Tan in response to parliamentary questions.

"Where immediate patching was not possible, alternative measures were put in place," he said.

Asked if any compromises or service disruptions had been detected, Mr Tan said there has been no evidence of the two flaws, collectively known as PHP2Shell, being exploited in government or CII systems.

The authorities will remain vigilant and continue assessing whether existing requirements for managing vulnerabilities were sufficient, he added – including systems maintained by third-party vendors.

Mr Tan also said artificial intelligence (AI) was accelerating the discovery of vulnerabilities while increasing the speed and scale of cyberattacks.

Organisations should monitor their systems for signs of compromise, he added, noting that they can refer to CSA's resources for guidance on how to respond if they are affected.

CNA Games Guess Word Crack the word, one row at a time Buzzword Create words using the given letters Mini Sudoku Tiny puzzle, mighty brain teaser Mini Crossword Small grid, big challenge Word Search Spot as many words as you can Show More Show Less

In response to a supplementary question from Member of Parliament Charlene Chen (PAP-Tampines) on practical help available to smaller businesses without dedicated cybersecurity teams, Mr Tan said the government recognised that they may not have the same resources as larger organisations.

He pointed to CSA's SG Cyber Safe programme and other government-supported initiatives, saying companies can receive up to 70 per cent co-funding for many of these measures.

There is also support for companies to engage professional cybersecurity firms to carry out vulnerability testing, he said.

Mr Tan added that the government had recently announced plans for a cyber incident helpline for companies, particularly small and medium enterprises, that may not know what to do or who to turn to after a breach.

"We will aim to launch a helpline as soon as we can," he said.

RISKS POSED BY PHP2SHELL

The PHP2Shell vulnerabilities affect all versions of PHP, said a CSA security alert issued on Oct 21.

They had remained hidden for more than a decade before being uncovered with the help of artificial intelligence.

The flaws could allow attackers to remotely execute code on vulnerable systems without authentication, potentially giving them control of affected web servers.

CSA said there had been reports of widespread exploitation attempts, as well as the development of multiple proof-of-concept exploits.

A security fix was subsequently released also on Oct 21, with organisations using PHP urged to update their systems promptly.

Get our pick of top stories and thought-provoking articles in your inbox

Stay updated with notifications for breaking news and our best stories

Join our channel for the top reads for the day on your preferred chat app

卫生部高级国务部长表示，各组织应继续监测其系统是否存在安全漏洞。

资料照片：这张摄于2017年5月13日的插图照片显示，一名男子手持笔记本电脑，屏幕上投射出网络代码。路透社/Kacper Pempel

这段音频由人工智能工具生成。

新加坡：卫生部高级政务部长陈杰豪周三（11月4日）在国会表示，没有证据表明政府系统或新加坡关键信息基础设施（CII）中的 PHP 漏洞被利用。

此前，10 月 21 日披露了 PHP（一种运行着全球约 70% 网站的编程语言）的严重缺陷，导致新加坡当局敦促各组织立即修补漏洞，以应对网络攻击威胁。

谭先生在回答议会质询时表示，信息披露后，新加坡政府科技局（GovTech）和新加坡网络安全局（CSA）与政府机构和关键信息基础设施所有者合作，识别并保护受影响的系统。

他说：“对于无法立即修补的地方，我们采取了替代措施。”

当被问及是否检测到任何安全漏洞或服务中断时，陈先生表示，目前还没有证据表明这两个漏洞（统称为 PHP2Shell）在政府或关键信息基础设施系统中被利用。

他补充说，当局将保持警惕，并继续评估现有的漏洞管理要求是否足够，包括第三方供应商维护的系统。

陈先生还表示，人工智能 (AI) 正在加速漏洞的发现，同时也在增加网络攻击的速度和规模。

他还补充说，各组织应监控其系统是否存在安全漏洞的迹象，并指出，如果受到影响，他们可以参考CSA的资源，以获得应对措施的指导。

CNA游戏 猜词游戏 逐行破解单词 流行词游戏 用给定的字母组成单词 迷你数独 小小谜题，挑战你的大脑 迷你填字游戏 小方格，大挑战 单词搜索 尽可能多地找出单词 显示更多 显示更少

针对国会议员陈嘉琳（人民行动党-淡滨尼）提出的关于没有专门网络安全团队的小型企业可获得哪些实际帮助的补充问题，陈先生表示，政府认识到他们可能没有像大型组织那样的资源。

他指出，CSA 的 SG Cyber​​ Safe 计划和其他政府支持的举措，可使企业获得高达 70% 的共同资助，用于实施其中许多措施。

他还表示，政府也支持企业聘请专业的网络安全公司进行漏洞测试。

陈先生补充说，政府最近宣布了一项计划，为企业（特别是中小企业）设立网络安全事件求助热线，这些企业在发生数据泄露后可能不知道该怎么办或该向谁求助。

他说：“我们将尽快开通求助热线。”

PHP2SHELL带来的风险

CSA 于 10 月 21 日发布的安全警报称，PHP2Shell 漏洞会影响所有版本的 PHP。

在人工智能的帮助下，他们隐藏了十多年才被发现。

这些漏洞可能允许攻击者在未经身份验证的情况下远程在易受攻击的系统上执行代码，从而有可能控制受影响的 Web 服务器。

CSA表示，有报告称存在广泛的漏洞利用尝试，以及多个概念验证漏洞的开发。

随后，官方也在 10 月 21 日发布了安全修复程序，并敦促使用 PHP 的组织及时更新其系统。

订阅我们的邮件，即可获取精选热点新闻和引人深思的文章。

订阅通知，第一时间获取突发新闻和精彩报道。

加入我们的频道，即可在您常用的聊天应用上获取当日热门文章。