Singapore organisations urged to patch critical PHP vulnerabilities immediately: CSA

PHP is widely used in websites, including those built on platforms such as WordPress, Drupal and Joomla.

Ms Fong said that many organisations, particularly small and medium-sized enterprises (SMEs) that rely on external IT vendors or hosting providers, may not realise their systems are affected.

According to a CSA security alert issued on Wednesday, the vulnerabilities affect all versions of PHP and could allow attackers to remotely execute code on vulnerable systems without authentication.

The agency said there had been reports of widespread exploitation attempts targeting the vulnerabilities, as well as the development of multiple proof-of-concept exploits.

The vulnerabilities have also prompted website operators around the world to take precautionary measures, with government websites in Europe and elsewhere going offline on Wednesday.

Cloud services firm Cloudflare recorded millions of exploitation attempts after the public disclosure of critical vulnerabilities in the widely used programming language PHP, CEO Matthew Prince said in a post on X late on Wednesday.

Developers of PHP on Wednesday released urgent new fixes to vulnerabilities that had been lurking in their software for years until they were uncovered using AI, saying all users were “encouraged to update immediately.”