Singapore’s cybersecurity authorities have urged organisations to urgently address critical vulnerabilities discovered in PHP, a widely used programming language that supports a significant portion of the internet. The call to action came from Gwenda Fong, Singapore’s Commissioner of Cybersecurity and chief executive of the Cyber Security Agency of Singapore (CSA), on October 22.

The vulnerabilities, which have existed in PHP for several years, were uncovered through artificial intelligence tools and disclosed globally on October 21. PHP developers released emergency patches on the same day to address these security flaws. Following the disclosure, governments and companies around the world took measures including temporarily shutting down websites and applications to mitigate the risk of cyberattacks exploiting the weaknesses.

Fong emphasized that organisations, particularly small and medium-sized enterprises that depend on external IT providers or hosting services, may be unaware that their systems are at risk. She stressed the immediate nature of the threat and urged all organisations operating websites or online services to verify whether their infrastructure relies on affected PHP versions. Those impacted were advised to prioritise patching internet-facing systems without delay and to check for any signs of prior compromise.

“Cybersecurity is a shared responsibility. Acting quickly now can prevent a vulnerability from becoming a serious incident,” Fong said, encouraging organisations uncertain about their exposure to consult their IT teams, website developers, or hosting providers. She also directed entities requiring technical information to CSA’s SingCERT alert for guidance and updates.

CSA noted that all versions of the PHP scripting language were affected. While no confirmed cyberattacks against Singaporean websites have been reported to date, the agency highlighted reports of widespread exploitation attempts and the emergence of multiple proof-of-concept exploits targeting the vulnerabilities.

GovTech, the agency responsible for Singapore’s digital government infrastructure, confirmed that it is collaborating with government bodies to implement necessary safeguards. It stated there is currently no evidence of government systems being compromised due to the PHP vulnerabilities. Where needed, affected government services may be taken offline temporarily as a precautionary measure to facilitate remediation.

International experts have commented on the situation as well. Madeline Lawrence, co-founder of Belgian cybersecurity firm Akido Security, noted that details about the flaws became public before fixes were fully developed, resulting in reported attacks shortly thereafter.

The urgency conveyed by Singapore’s cybersecurity leadership highlights the rapid pace at which software vulnerabilities can become active threats and underscores the importance of timely patching to maintain digital security.