Singapore organisations urged to patch critical PHP vulnerabilities immediately: CSA

Singapore organisations are being urged to urgently patch two critical vulnerabilities in PHP, a widely used programming language for websites and online services. The vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), could allow attackers to take control of affected web servers without needing login credentials, potentially exposing data and disrupting services.

Commissioner of Cybersecurity and Cyber Security Agency of Singapore (CSA) chief executive Gwenda Fong stated that the threat is immediate, with working exploits already demonstrated and security patches released. The agency is working with various stakeholders to accelerate patching and has advised organisations to check their systems and apply security patches immediately.

Brief written by urgent.news from CNA - Singapore's own syndicated text. Machine-written — may contain errors; check the original before relying on it.