SINGAPORE: Organisations in Singapore have been urged to patch two critical vulnerabilities in PHP, a programming language widely used to power websites and online services, as attackers could exploit affected systems without needing login credentials.
The vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), could potentially allow attackers to take control of web servers, steal data or disrupt services, said Commissioner of Cybersecurity and Cyber Security Agency of Singapore (CSA) chief executive Gwenda Fong in a LinkedIn post on Thursday (Oct 22).
Ms Fong said that the threat was immediate, with working exploits already demonstrated and security patches released on Wednesday.
The priority now is to identify and patch vulnerable systems before attackers can exploit them, she said.
CNA Games
Show More Show Less
PHP is widely used in websites, including those built on platforms such as WordPress, Drupal and Joomla.
Ms Fong said that many organisations, particularly small and medium-sized enterprises (SMEs) that rely on external IT vendors or hosting providers, may not realise their systems are affected.
According to a CSA security alert issued on Wednesday, the vulnerabilities affect all versions of PHP and could allow attackers to remotely execute code on vulnerable systems without authentication.
The agency said there had been reports of widespread exploitation attempts targeting the vulnerabilities, as well as the development of multiple proof-of-concept exploits.
The vulnerabilities have also prompted website operators around the world to take precautionary measures, with government websites in Europe and elsewhere going offline on Wednesday.
Cloud services firm Cloudflare recorded millions of exploitation attempts after the public disclosure of critical vulnerabilities in the widely used programming language PHP, CEO Matthew Prince said in a post on X late on Wednesday.
Developers of PHP on Wednesday released urgent new fixes to vulnerabilities that had been lurking in their software for years until they were uncovered using AI, saying all users were "encouraged to update immediately."
CSA said it was "working urgently" with government agencies, critical information infrastructure owners, major enterprises and industry partners to accelerate patching.
It is also reaching out through business associations, cybersecurity service providers and technology partners to help smaller organisations address the vulnerabilities.
"My message to every organisation in Singapore is simple: do not wait," said Ms Fong.
She urged organisations operating websites or online services to check whether their systems, including those managed by third-party vendors, use affected versions of PHP.
Affected organisations should immediately apply security patches, prioritising internet-facing systems, and investigate whether their systems may already have been compromised.
Those unsure whether their systems are vulnerable should contact their IT teams, website developers or hosting providers, she added.
"Cybersecurity is a shared responsibility. Acting quickly now can prevent a vulnerability from becoming a serious incident," said Ms Fong.
Continue reading...
The vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), could potentially allow attackers to take control of web servers, steal data or disrupt services, said Commissioner of Cybersecurity and Cyber Security Agency of Singapore (CSA) chief executive Gwenda Fong in a LinkedIn post on Thursday (Oct 22).
Ms Fong said that the threat was immediate, with working exploits already demonstrated and security patches released on Wednesday.
The priority now is to identify and patch vulnerable systems before attackers can exploit them, she said.
CNA Games
Show More Show Less
PHP is widely used in websites, including those built on platforms such as WordPress, Drupal and Joomla.
Ms Fong said that many organisations, particularly small and medium-sized enterprises (SMEs) that rely on external IT vendors or hosting providers, may not realise their systems are affected.
According to a CSA security alert issued on Wednesday, the vulnerabilities affect all versions of PHP and could allow attackers to remotely execute code on vulnerable systems without authentication.
The agency said there had been reports of widespread exploitation attempts targeting the vulnerabilities, as well as the development of multiple proof-of-concept exploits.
The vulnerabilities have also prompted website operators around the world to take precautionary measures, with government websites in Europe and elsewhere going offline on Wednesday.
Cloud services firm Cloudflare recorded millions of exploitation attempts after the public disclosure of critical vulnerabilities in the widely used programming language PHP, CEO Matthew Prince said in a post on X late on Wednesday.
Developers of PHP on Wednesday released urgent new fixes to vulnerabilities that had been lurking in their software for years until they were uncovered using AI, saying all users were "encouraged to update immediately."
Related:
CSA said it was "working urgently" with government agencies, critical information infrastructure owners, major enterprises and industry partners to accelerate patching.
It is also reaching out through business associations, cybersecurity service providers and technology partners to help smaller organisations address the vulnerabilities.
"My message to every organisation in Singapore is simple: do not wait," said Ms Fong.
She urged organisations operating websites or online services to check whether their systems, including those managed by third-party vendors, use affected versions of PHP.
Affected organisations should immediately apply security patches, prioritising internet-facing systems, and investigate whether their systems may already have been compromised.
Those unsure whether their systems are vulnerable should contact their IT teams, website developers or hosting providers, she added.
"Cybersecurity is a shared responsibility. Acting quickly now can prevent a vulnerability from becoming a serious incident," said Ms Fong.
Continue reading...