Firms in Singapore should ‘act now’ to fix critical PHP vulnerabilities:

Artificial intelligence tools recently identified critical vulnerabilities in PHP, a programming language underpinning a significant portion of the internet. These flaws had reportedly resided in the software for years. Following the release of urgent fixes on October 21 by PHP developers, cybersecurity agencies worldwide issued warnings, leading to governments and companies temporarily shutting down websites and applications to implement protections.

Singapore’s Commissioner of Cybersecurity, Gwenda Fong, emphasized the immediate threat on October 22, urging all Singaporean organizations to act without delay. She highlighted that many, particularly small and medium-sized enterprises relying on external IT vendors or hosting providers, might not realize their systems are affected. Organizations are advised to check if their systems use affected PHP versions, patch internet-facing systems immediately, and investigate for signs of prior compromise.

The Cyber Security Agency of Singapore (CSA) is actively collaborating with government agencies, critical information infrastructure owners, and industry partners to accelerate patching efforts. While no local websites are known to have been compromised by hackers, CSA noted widespread exploitation attempts and the development of proof-of-concept exploits globally. GovTech, managing Singapore’s digital government, confirmed no indication of government systems being compromised, with temporary service outages possible as a precautionary measure.