No evidence PHP vulnerabilities exploited in Government or critical infrastructure systems: Tan Kiat How

There is no evidence of recently disclosed PHP vulnerabilities being exploited in government or critical information infrastructure (CII) systems, said Senior Minister of State for Digital Development and Information Tan Kiat How on Wednesday (Nov 4).

He was responding to parliamentary questions filed by members of parliament Alex Yeo (Potong Pasir SMC) and Dr Charlene Chen (Tampines GRC), who had asked whether government or CII systems had been affected by the vulnerabilities.

Dr Chen also asked how the Government ensures timely identification and remediation of vulnerabilities in widely used software, including third-party applications.

PHP is a programming language used to power websites and online services. It is widely used, including in websites built on platforms such as WordPress, Drupal and Joomla.

When a visitor loads a page, a server running PHP assembles the content and sends it to the browser. It is free, open-source software maintained by volunteers.

The vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), have reportedly been lurking in the programming language for years before they were uncovered using artificial intelligence, according to the software's developers.

These could allow attackers to exploit affected systems without needing login credentials, potentially taking control of web servers, stealing data or disrupting services.

In his reply, Tan said the Cyber Security Agency of Singapore (CSA) and Government Technology Agency (GovTech) worked quickly with government agencies and CII owners to identify and secure affected systems.

Where immediate patching was not possible, alternative measures were put in place, he added.

Tan said all parties must remain vigilant, and that the relevant agencies will continue assessing whether existing requirements for managing vulnerabilities remain sufficient.

Such requirements should also cover systems maintained by third-party vendors, he added.

"Artificial intelligence (AI) is accelerating the discovery of vulnerabilities and increasing the speed and scale of cyber attacks. Organisations can and should monitor their systems for signs of compromise."

In a supplementary question, Dr Chen said the incident served as a reminder that cyber threats are real.

She noted that a single software weakness can impact government systems and businesses alike, potentially disrupting critical services and exposing consumers' sensitive data.

The MP also asked what practical assistance is available for smaller businesses that may not have dedicated cybersecurity teams to determine whether they are affected and respond quickly.

Responding to the question, Tan encouraged small and medium enterprises (SMEs) to make full use of the various support initiatives and programmes offered by agencies, such as the Cyber Security Agency of Singapore's (CSA) SG Cyber Safe Programme.

The programme helps Singapore organisations better protect themselves in the digital domain and enhance their cybersecurity.

Tan noted that government support of up to 70 per cent co-funding is available under some of these initiatives.

Tan also highlighted CSA's Cybersecurity Health Plan service and the CISO-as-a-Service programme, which help companies assess and strengthen their cybersecurity posture.

He also pointed to the upcoming Cyber Incident Helpline, which provides organisations with practical assistance when cyber incidents occur.

The helpline provides initial incident triage, advisory support and referrals to relevant service providers and resources, helping organisations understand the next steps to contain an incident and begin recovery.

Businesses and organisations can visit CSA's website for more information.

新加坡数字发展及新闻部高级政务部长陈杰豪周三（11月4日）表示，没有证据表明最近披露的 PHP 漏洞在政府或关键信息基础设施 (CII) 系统中被利用。

他是在回应国会议员杨耀祥（波东巴西单选区）和陈嘉琳医生（淡滨尼集选区）提出的议会质询，他们询问政府或关键信息基础设施系统是否受到了这些漏洞的影响。

陈博士还询问政府如何确保及时发现和修复广泛使用的软件（包括第三方应用程序）中的漏洞。

PHP 是一种用于构建网站和在线服务的编程语言。它被广泛使用，包括在 WordPress、Drupal 和 Joomla 等平台上构建的网站。

当访客加载页面时，运行 PHP 的服务器会组装内容并将其发送到浏览器。PHP 是由志愿者维护的免费开源软件。

据软件开发人员称，这些漏洞统称为 PHP2Shell（CVE-2026-109618 和 CVE-2026-109619），多年来一直潜伏在该编程语言中，直到使用人工智能才被发现。

这些漏洞可能使攻击者无需登录凭证即可利用受影响的系统，从而有可能控制网络服务器、窃取数据或中断服务。

陈先生在回复中表示，新加坡网络安全局 (CSA) 和政府科技局 (GovTech) 与政府机构和关键信息基础设施所有者迅速合作，以识别和保护受影响的系统。

他还补充说，对于无法立即修补的地方，则采取了替代措施。

谭表示，各方都必须保持警惕，相关机构将继续评估现有的漏洞管理要求是否仍然足够。

他还补充说，此类要求也应涵盖第三方供应商维护的系统。

“人工智能（AI）正在加速漏洞的发现，并提高网络攻击的速度和规模。各组织可以而且应该监控其系统，以发现任何入侵迹象。”

陈博士在补充提问中表示，该事件提醒人们网络威胁是真实存在的。

她指出，单个软件漏洞可能会对政府系统和企业造成影响，有可能中断关键服务并泄露消费者的敏感数据。

该议员还询问，对于可能没有专门网络安全团队的小型企业，有哪些实际的援助可以帮助它们确定是否受到影响并迅速做出反应。

针对这个问题，谭先生鼓励中小企业充分利用各机构提供的各种支持计划和方案，例如新加坡网络安全局 (CSA) 的 SG Cyber​​ Safe 计划。

该计划旨在帮助新加坡企业更好地保护自身在数字领域的安全，并提升其网络安全水平。

谭指出，在其中一些举措下，政府可提供高达 70% 的共同资助。

Tan 还重点介绍了 CSA 的网络安全健康计划服务和 CISO 即服务计划，这些计划可以帮助公司评估和加强其网络安全状况。

他还提到了即将推出的网络安全事件求助热线，该热线将在发生网络安全事件时为组织提供实际帮助。

该热线提供初步事件分类、咨询支持以及向相关服务提供商和资源的转介，帮助组织了解控制事件和开始恢复的下一步措施。

企业和组织可以访问CSA的网站了解更多信息。