Singapore’s Cyber Security Agency ordered banks, government suppliers and small businesses on Thursday to patch two critical flaws in the PHP programming language immediately, warning that active exploitation had already been observed worldwide.
Commissioner of Cybersecurity Gwenda Fong, who also leads the agency, said the vulnerabilities—tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell—affect every supported PHP release and could let attackers take control of web servers, steal data or knock services offline without valid login credentials. “The threat is immediate,” she wrote on LinkedIn. “Do not wait.”
What broke and who spotted it
Researchers using artificial intelligence tools uncovered the bugs after they had lurked undetected for years, prompting emergency fixes from PHP maintainers on Wednesday. CSA’s alert said proof-of-concept code was circulating and that Cloudflare chief executive Matthew Prince reported millions of exploit attempts within hours of public disclosure.
PHP underpins large parts of the public internet, including WordPress, Drupal and Joomla sites. Many Singapore SMEs rely on outsourced developers or hosting providers and may not know whether their storefronts run vulnerable builds—a gap Fong highlighted as she urged tenants to call vendors today rather than after a breach.
Local impact so far
Unlike some European ministries that took citizen portals offline preemptively, Singapore authorities said the priority is accelerated patching rather than blanket shutdowns. Government agencies are applying fixes through the Government Cybersecurity Posture programme, while CSA hotlines field questions from schools, clinics and charities that discovered PHP in legacy donation portals.
The alert lands a day after the United Kingdom’s National Cyber Security Centre told public bodies to disconnect exposed PHP instances, and as Australian Signals Directorate staff worked through similar hardening on cyber.gov.au. Singapore’s message is aligned with those allies but emphasises vendor accountability: organisations that discover compromise must report to CSA and preserve logs for investigators.
What operators should do
CSA’s checklist mirrors global guidance: inventory internet-facing PHP, apply vendor patches before re-exposing services, and hunt for webshells or unusual cron jobs that suggest PHP2Shell was already used. Firms using managed hosting should obtain written confirmation from providers that patches are live, not merely scheduled.
Insurance and contractual penalties for data breaches make delay expensive, Fong noted, especially for firms handling Singpass-linked transactions or electronic payment licences. With exploit traffic still climbing on Content Delivery Networks, Singapore’s cyber chief framed Thursday’s order as a race—patch now, or explain later why a known flaw was left open.