Singapore organisations urged to patch critical PHP flaws immediately amid cyberattack threat

SINGAPORE: Organisations in Singapore have been urged to immediately fix two critical security flaws in a widely used programming language, amid reports of widespread attempts by hackers to exploit the vulnerabilities.

The flaws in PHP, which powers many websites and online services, could allow attackers to take control of web servers, steal data or disrupt services without needing login credentials, said Singapore's Commissioner of Cybersecurity Gwenda Fong on Thursday (Oct 22).

"The threat is immediate," Ms Fong, who is also chief executive of the Cyber Security Agency of Singapore (CSA), said in a LinkedIn post.

Working exploits have already been demonstrated, and security patches were released on Wednesday, she added.

The vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), affect all versions of PHP, according to a CSA security alert issued on Wednesday.

The agency said there had been reports of widespread exploitation attempts, as well as the development of multiple proof-of-concept exploits.

Cloud services firm Cloudflare recorded millions of attempts to exploit the vulnerabilities following their public disclosure, its chief executive Matthew Prince said in a post on X late on Wednesday.

The flaws have also prompted website operators around the world to take precautionary measures, with government websites in Europe and elsewhere going offline on Wednesday.

PHP developers released urgent security fixes on Wednesday for vulnerabilities that had gone undetected for years before being uncovered using artificial intelligence, urging users to update immediately.

Ms Fong warned that many organisations, particularly small and medium-sized enterprises (SMEs) that rely on external IT vendors or hosting providers, may not realise their systems are vulnerable.

PHP is widely used in websites, including those built on platforms such as WordPress, Drupal and Joomla.

"My message to every organisation in Singapore is simple: do not wait," she said.

Organisations operating websites or online services should check whether their systems use affected versions of PHP, including those managed by third-party vendors.

They should apply security patches immediately, prioritising systems accessible from the internet, and investigate whether their systems may already have been compromised, Ms Fong added.

Those unsure whether they are affected should contact their IT teams, website developers or hosting providers.

CSA said it was working urgently with government agencies, critical information infrastructure owners, major enterprises and industry partners to accelerate patching.

It is also reaching out through business associations, cybersecurity service providers and technology partners to help smaller organisations address the vulnerabilities.

"The priority now is to identify and patch vulnerable systems before attackers can exploit them," Ms Fong said.

"Cybersecurity is a shared responsibility. Acting quickly now can prevent a vulnerability from becoming a serious incident."