Singapore warns of critical PHP vulnerabilities that could expose web servers to hackers

International media reported that a serious security flaw in the widely used internet programming language PHP has shaken the foundations of countless websites and online services worldwide ― Unsplash pic

First Published: Friday, 23 Oct 2026 10:52 AM MYT

SINGAPORE, Oct 23 — The Cyber Security Agency of Singapore (CSA) urged organisations to promptly act against critical vulnerabilities in PHP, a technology widely used to power websites and online services.

Its chief executive, Gwenda Fong, said the two vulnerabilities discovered in PHP were concerning, as cyber attackers could exploit affected systems without needing login credentials, potentially taking control of web servers, stealing data or disrupting services.

She said the threat was immediate, with working exploits having been demonstrated and security patches released on Oct 21.

Fong stressed that the priority for Singapore organisations now is to identify and patch vulnerable systems before cyber attackers can exploit them.

“CSA is working urgently with government agencies, critical information infrastructure owners, major enterprises and industry partners to accelerate patching. 

“We are also reaching out through business associations, cybersecurity service providers and technology partners to help smaller organisations take action,” she said in her LinkedIn page yesterday. 

According to the CSA advisory, organisations should identify systems running any version of PHP and apply the security updates, prioritising internet-facing systems. 

“Organisations should further check whether PHP is installed on their web servers, including where it may be used by third-party applications or components, even if their primary websites do not use PHP,” it added.

International media reported that a serious security flaw in the widely used internet programming language PHP has shaken the foundations of countless websites and online services worldwide

Security experts warned of two critical vulnerabilities in the core of the programming language, dubbed “PHP2Shell” and registered under the official identifiers CVE-2026-109618 and CVE-2026-109619. — Bernama