Singapore urges immediate patching of critical PHP flaws after global exploit attempts
Singapore's cyber agency warned organisations to apply urgent patches for two critical PHP vulnerabilities that are being actively exploited worldwide.
On Thursday, Gwenda Fong, commissioner of the Cyber Security Agency of Singapore, issued an urgent alert about two critical PHP vulnerabilities, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), that affect every version of the language. Working exploits have been shown, and Cloudflare observed millions of attempts to abuse the flaws after their public disclosure. The agency released patches on Wednesday and warned that the threat is immediate, particularly for small and medium-sized enterprises using external vendors or hosting services.
Organisations are instructed to verify whether their web servers run vulnerable PHP, apply the updates without delay, and investigate any signs of compromise. CSA is coordinating with government bodies, critical infrastructure owners, and industry partners to accelerate remediation and is reaching out through business groups to help smaller firms protect their online services.
Why it matters
Unpatched PHP servers can be hijacked, exposing data and disrupting services for businesses worldwide.
How this story developed
- Oct 12 Cyberattack disrupts refrigeration systems at Intermarché and Coopérative U stores
- Oct 12 The attack specifically exploits outdated Danfoss software versions older than version 4.
- Oct 14 Additional reports note that stores of Monoprix, Leclerc and Carrefour also experienced temperature overrides.
- Oct 21 PHP maintainers announced they will release emergency updates for two high-severity flaws, each rated 9.2/10, in just over a day.
- Oct 21 EU’s CERT‑EU recommended that organisations unable to patch consider taking vulnerable sites offline.
- Oct 22 German state portals, including Berlin and Hessen, were restored after applying the emergency PHP patches.
In this story
Related stories
15 in this thread