Firms here should ‘act now’ to fix critical PHP vulnerabilities: Singapore’s cybersecurity chief

SINGAPORE - Organisations in Singapore should act now to address critical vulnerabilities in PHP, a programming language that powers a large share of the internet, said Singapore’s Commissioner of Cybersecurity Gwenda Fong on Oct 22. 

Her comment on LinkedIn comes after cybersecurity agencies across the world warned about two critical vulnerabilities discovered in PHP on Oct 21.

PHP developers released urgent fixes on Oct 21 for vulnerabilities that had resided in the software for years until they were uncovered by artificial intelligence tools.

These warnings prompted governments and companies worldwide to shut down websites and apps as they raced to protect themselves from potential cyber attacks.

“My message to every organisation in Singapore is simple: do not wait,” said Fong, who is also chief executive of the Cyber Security Agency of Singapore (CSA).

She said that many organisations, especially small and medium-sized enterprises that rely on external IT vendors or hosting providers, may not realise that their systems are affected. But she said that the threat is immediate.

“CSA is working urgently with government agencies, Critical Information Infrastructure owners, major enterprises and industry partners to accelerate patching. We are also reaching out through business associations, cybersecurity service providers and technology partners to help smaller organisations take action,” she said. 

Fong said that those who operate websites or online services should check whether their systems, including those managed by third-party vendors, use affected versions of PHP.

They should also patch immediately, prioritising internet-facing systems, and investigate whether there are signs that their systems may already have been compromised.

“If you are unsure whether your organisation is affected, contact your IT team, website developer or hosting provider today,” she said.

“Cybersecurity is a shared responsibility. Acting quickly now can prevent a vulnerability from becoming a serious incident.”

She referred those who require technical guidance and updates to CSA’s SingCERT alert.

On Oct 21, CSA said that the exposed vulnerabilities affect all versions of the scripting language. Even though there are no known cases of websites here taken down by hackers, CSA said: “There have been reports of widespread exploitation attempts targeting these vulnerabilities, as well as the development of multiple proof-of-concept exploits.”

GovTech, which powers Singapore’s digital government, said it is working closely with government agencies to implement the necessary precautionary measures.

“There is currently no indication that any Government systems have been compromised as a result of these vulnerabilities,” said GovTech.

“Where necessary, affected services may be temporarily taken offline to facilitate remediation. Such measures are precautionary and do not indicate that the systems have been compromised.”

A Reuters report quoted Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, as saying: “Details of these flaws became public before fixes were ready, and attacks have since been reported.”