Singapore pushes for quick action on PHP security flaws as hackers prowl

Singapore's cybersecurity agency is urging organizations to promptly address two critical security flaws in PHP, a popular programming language powering numerous websites and online services. These vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), could enable hackers to gain control of web servers, pilfer data, or disrupt services without needing login credentials.

Commissioner of Cybersecurity Gwenda Fong, who also leads the Cyber Security Agency of Singapore (CSA), warned that the threat is immediate, stating, "The threat is immediate." Exploits have already been demonstrated, and patches were released on Wednesday. The flaws affect all PHP versions and have prompted widespread exploitation attempts and proof-of-concept exploits.

Cloudflare, a cloud services provider, recorded millions of such attempts after the vulnerabilities' public disclosure. Government websites worldwide went offline out of precaution. PHP developers released urgent security fixes, emphasizing the need for immediate updates. Fong cautioned that many organizations, particularly SMEs relying on external IT vendors or hosting providers, may be unaware of their vulnerability.

PHP is prevalent in platforms like WordPress, Drupal, and Joomla. Organizations must verify if their systems use affected PHP versions, prioritize patching systems accessible from the internet, and verify if they have been compromised. The CSA is collaborating with government agencies, critical infrastructure owners, enterprises, and industry partners to expedite patching efforts.

Acting swiftly can prevent a vulnerability from escalating into a major incident, as cybersecurity is a shared responsibility.