Singapore organisations urged to patch critical PHP flaws immediately amid cyberattack threat

Singaporean organisations have been urged to urgently patch critical security flaws in the PHP programming language to prevent cyberattacks. The vulnerabilities, collectively called PHP2Shell (CVE-2026-109618 and CVE-2026-109619), could allow attackers to take full control of affected web servers without needing login credentials, potentially exposing data and disrupting services.

Commissioner of Cybersecurity Gwenda Fong warned that working exploits had already been demonstrated and that security patches were released on Wednesday. Cloudflare reported millions of attempts to exploit the vulnerabilities following their public disclosure, and government websites in Europe went offline as a precaution. PHP, which powers many websites and online services, affects all versions of the programming language.

Ms Fong emphasised that many organisations, particularly SMEs, may not realise their systems are vulnerable, as the flaws had gone undetected for years. She urged organisations to immediately check if their systems use affected PHP versions, apply security patches, and investigate potential compromises. The Cyber Security Agency of Singapore (CSA) is working with government agencies, critical infrastructure owners, enterprises, and industry partners to accelerate patching and reach out to smaller organisations for assistance.

The priority is to identify and patch vulnerable systems before attackers can exploit them, as cybersecurity is a shared responsibility.