Singapore pushes for quick action on PHP security flaws as hackers prowl

Organisations in Singapore have been urged to immediately fix two critical security flaws in a widely used programming language amid reports of widespread attempts by hackers to exploit the vulnerabilities.The flaws in PHP, which powers many websites and online services, could allow attackers to take control of web servers, steal data or disrupt services without needing login credentials, Singapore’s Commissioner of Cybersecurity Gwenda Fong said on Thursday.“The threat is immediate,” Fong, who is also CEO of the Singapore" class="entity-link entity-organization" data-entity-id="221281" data-entity-type="organization">Cyber Security Agency of Singapore (CSA), said in a social media post.Working exploits have already been demonstrated and security patches were released on Wednesday, she added.The vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), affect all versions of PHP, according to a CSA security alert issued on Wednesday.The agency said there had been reports of widespread exploitation attempts, as well as the development of multiple proof-of-concept exploits.Cloud services firm Cloudflare recorded millions of attempts to exploit the vulnerabilities following their public disclosure, its CEO Matthew Prince said in a social media post late on Wednesday.