Cybersecurity chief urges immediate patch to critical PHP vulnerabilities

Attackers can breach affected systems without login credentials, risking data.

Organisations should quickly address systems after two critical vulnerabilities were discovered in PHP, said Cyber Security Agency (CSA) Commissioner Gwenda Fong on 22 October.

Two critical flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) can let attackers bypass login credentials to take over web servers, steal data or disrupt services.

PHP developers released security patches on 21 October.

PHP is a widely used scripting language for websites and online services, including platforms such as WordPress, Drupal, and Joomla.

Fong said that many organisations, especially small and medium enterprises (SMEs), may not realise that their systems could already be compromised, marking the threat as “immediate”.

She said that organisations must check if their services are using affected PHP versions, and to patch immediately, prioritising internet-facing systems. They should also investigate whether their systems have been breached.

The cybersecurity chief said that organisations unsure of their security status should contact their IT teams, website developers or hosting providers as soon as possible.

“CSA is working urgently with government agencies, Critical Information Infrastructure owners, major enterprises and industry partners to accelerate patching,” Fong said.

The agency is also reaching out through business associations, cybersecurity service providers and technology partners to help smaller organisations take action.

Companies may refer to CSA’s SingCERT alert for technical guidance and updates.

Follow the link for more news on

cybersecurity

Reaching the people who run Asia's businesses is harder than it used to be.

Inboxes are crowded. Attention is short. The executives you most want to reach — the founders, CFOs, and operators who actually move budgets — are the hardest to find through the usual channels. If you're building a company, a category, or a reputation, you already know this.

We've spent twenty years building the room they read. Singapore Business Review is where senior decision makers in Singapore and across Southeast Asia come for business coverage they can't get elsewhere — in print, online, and in person at the summits and roundtables we host across seven markets.

If you have something these readers should know about — a point of view worth publishing, a product worth their attention, an event worth their time — we'd like to hear what you're trying to do.

Book a meeting

| Or download the media kit (PDF)

240,000 senior readers quarterly in print Top 1,700 Singapore companies reached

7 markets across Southeast Asia