\n<\/p>\n
SINGAPORE: Organisations in Singapore have been urged to patch two critical vulnerabilities in PHP, a programming language widely used to power websites and online services, as attackers could exploit affected systems without needing login credentials.<\/p>\n
The vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), could potentially allow attackers to take control of web servers, steal data or disrupt services, said Commissioner of Cybersecurity and Cyber Security Agency of Singapore (CSA) chief executive Gwenda Fong in a LinkedIn post on Thursday (Oct 22).<\/p>\n
Ms Fong said that the threat was immediate, with working exploits already demonstrated and security patches released on Wednesday.<\/p>\n
The priority now is to identify and patch vulnerable systems before attackers can exploit them, she said.<\/p>\n
PHP is widely used in websites, including those built on platforms such as WordPress, Drupal and Joomla.<\/p>\n
Ms Fong said that many organisations, particularly small and medium-sized enterprises (SMEs)<\/span> that rely on external IT vendors or hosting providers, may not realise their systems are affected.<\/p>\n According to a CSA security alert issued on Wednesday, the vulnerabilities affect all versions of PHP and could allow attackers to remotely execute code on vulnerable systems without authentication.<\/p>\n The agency said there had been reports of widespread exploitation attempts targeting the vulnerabilities, as well as the development of multiple proof-of-concept exploits.<\/span><\/p>\n The vulnerabilities have also prompted website operators around the world to take precautionary measures, with government websites in Europe and elsewhere going offline on Wednesday.<\/span><\/p>\n Cloud services firm Cloudflare recorded millions of exploitation attempts after the public disclosure of critical vulnerabilities in the widely used programming language PHP, CEO Matthew Prince said in a post on X late on Wednesday.<\/p>\n Developers of PHP on Wednesday released urgent new fixes to vulnerabilities that had been lurking in their software for years until they were uncovered using AI, saying all users were “encouraged to update immediately.”<\/p>\n<\/div>\n
\n
\n
Read Full Article At Source <\/a>
\n