No evidence PHP flaws exploited in government, critical infrastructure systems: Tan Kiat How

SINGAPORE: There is no evidence that PHP vulnerabilities were exploited in government systems or Singapore's critical information infrastructure (CII), said Senior Minister of State for Health Tan Kiat How in parliament on Wednesday (Nov 4).

This follows the Oct 21 disclosure of critical flaws in PHP, a programming language that runs about 70 per cent of the world's websites, leading Singapore authorities to urge organisations to patch gaps immediately amid cyberattack threat.

Following the disclosure, the Government Technology Agency (GovTech) and Cyber Security Agency of Singapore (CSA) worked with government agencies and CII owners to identify and secure affected systems, said Mr Tan in response to parliamentary questions.

"Where immediate patching was not possible, alternative measures were put in place," he said.

Asked if any compromises or service disruptions had been detected, Mr Tan said there has been no evidence of the two flaws, collectively known as PHP2Shell, being exploited in government or CII systems. 

The authorities will remain vigilant and continue assessing whether existing requirements for managing vulnerabilities were sufficient, he added – including systems maintained by third-party vendors.

Mr Tan also said artificial intelligence (AI) was accelerating the discovery of vulnerabilities while increasing the speed and scale of cyberattacks.

Organisations should monitor their systems for signs of compromise, he added, noting that they can refer to CSA's resources for guidance on how to respond if they are affected.