Firms here should ‘act now’ to fix critical PHP vulnerabilities: Singapore’s cybersecurity chief

Singapore's Commissioner of Cybersecurity, Gwenda Fong, urged organisations to address critical PHP vulnerabilities immediately. PHP, a programming language powering a significant portion of the internet, has two newly discovered critical vulnerabilities that have been present for years. These vulnerabilities were uncovered by artificial intelligence tools on October 21, prompting global warnings.

Fong called on all organisations in Singapore, particularly small and medium-sized enterprises, not to delay action. The Cyber Security Agency of Singapore (CSA) is collaborating with government agencies, critical information infrastructure owners, major enterprises, and industry partners to expedite patching. Fong stressed that those running websites or online services should verify if their systems, including those managed by third-party vendors, use the affected PHP versions.

Immediate patching is recommended, with priority given to internet-facing systems. If uncertain, organisations should contact their IT team, website developer, or hosting provider. While no Singaporean websites have been compromised, there have been reports of exploitation attempts targeting these vulnerabilities. The Government Technology Agency (GovTech) has stated that there is no evidence of government systems being compromised, but advises taking precautionary measures by temporarily shutting down affected services.