Singapore agency warns PHP flaws could expose servers and data

Singapore’s Cyber Security Agency (CSA) has urged organisations to address critical vulnerabilities in PHP, warning that attackers could use them to take control of web servers without login credentials, steal data or disrupt services. The agency’s warning covers every version of the programming language, which supports websites and online services.

Commissioner of Cybersecurity and CSA chief executive Gwenda Fong called the threat immediate in a LinkedIn post and urged organisations not to delay action. Her warning focuses on the risk that the flaws could expose servers and information or interrupt online services if exploited. PHP developers released fixes on Oct 21.

Fong’s call to act followed warnings from cybersecurity agencies around the world on Oct 21 about two critical PHP vulnerabilities. The CSA also issued a security alert on Wednesday describing the vulnerabilities and reporting widespread exploitation attempts and the development of multiple proof-of-concept exploits.

The vulnerabilities are collectively known as PHP2Shell and identified as CVE-2026-109618 and CVE-2026-109619. The CSA said they affect all PHP versions. The potential consequences outlined by the agency include server takeover, data theft and service disruption; its warning specifies that attackers would not need login credentials to take control of affected servers.

Cloudflare chief executive Matthew Prince said the company recorded millions of attempts to exploit the flaws after their public disclosure. That figure describes attempts observed by Cloudflare, not confirmed successful compromises. The CSA alert separately described exploitation attempts as widespread.

The accounts emphasize different parts of the warning without contradicting one another: CNA reports the potential technical consequences and the CSA alert’s exploitation warnings, while The Straits Times foregrounds the release of urgent fixes and Fong’s appeal for organisations to act.

The Straits Times also reports that the vulnerabilities had remained in PHP for years before artificial intelligence tools helped uncover them. The immediate decision facing organisations is whether to apply the released fixes to PHP systems they operate.

The CSA’s warning identifies the stakes of delay: attackers could gain control of web servers, access data or interrupt services, while the reported exploitation activity makes the vulnerabilities an active security concern.