SINGAPORE — Singapore has found no evidence that recently disclosed vulnerabilities in the widely used PHP programming language have been exploited in government or critical information infrastructure systems, Senior Minister of State for Digital Development and Information Tan Kiat How told Parliament on November 4.
The update offers reassurance amid growing international concern over two serious software vulnerabilities that could allow hackers to take control of affected web servers without needing login credentials.
Tan said the Cyber Security Agency of Singapore (CSA) and the Government Technology Agency (GovTech) had worked quickly with government agencies and owners of critical information infrastructure to identify and secure affected systems.
Where immediate software patching was not possible, alternative protective measures were introduced.
However, the Government is not treating the absence of confirmed attacks as a reason to relax its cybersecurity efforts. Tan said agencies would continue reviewing whether existing requirements for identifying and fixing software vulnerabilities remain sufficient, including those involving systems maintained by third-party vendors.
His parliamentary response also highlighted a growing concern for businesses: as artificial intelligence accelerates the discovery of software weaknesses, organisations may have less time to respond before attackers attempt to exploit them.
No evidence of exploitation in government or critical infrastructure
Tan was responding to parliamentary questions filed by Alex Yeo, Member of Parliament for Potong Pasir SMC, and Dr Charlene Chen of Tampines GRC.
The lawmakers asked whether government systems or critical information infrastructure had been affected by the recently disclosed PHP vulnerabilities.
Dr Chen also raised questions about how the Government ensures that weaknesses in widely used software are identified and addressed promptly, particularly when organisations depend on third-party applications and technology providers.
In his response, Tan said there was no evidence that the vulnerabilities had been exploited in government or critical information infrastructure systems.
He explained that CSA and GovTech had coordinated with relevant government agencies and critical infrastructure owners to identify affected systems and implement security measures.
Where organisations could not immediately install the necessary patches, alternative safeguards were put in place to reduce exposure.
The distinction is important: saying there is no evidence of exploitation does not mean that every system is automatically free from risk. It means that authorities have not identified evidence that the specific vulnerabilities were used to compromise the government or critical infrastructure systems covered by the assessment.
Tan also stressed the need for continued vigilance and further review of existing vulnerability-management requirements.
What exactly are the PHP2Shell vulnerabilities?
The security weaknesses are collectively known as PHP2Shell and involve two vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.
PHP is a widely used, open-source programming language that helps websites and online services operate. It is commonly used in applications and platforms built with technologies such as WordPress, Drupal and Joomla.
When someone visits a PHP-powered website, the server processes the necessary instructions and delivers the resulting page to the visitor’s browser.
Because PHP is used across a large number of websites and online services, weaknesses in the language can potentially affect organisations in different industries.
The two PHP2Shell vulnerabilities are particularly serious because successful exploitation could allow an attacker to execute arbitrary code remotely without first obtaining legitimate login credentials.
In simpler terms, an attacker could potentially send malicious requests to a vulnerable server and cause it to run unauthorised instructions.
The first vulnerability, CVE-2026-109618, involves an out-of-memory handling weakness. The second, CVE-2026-109619, involves a use-after-free flaw, a type of memory-management error.
Both vulnerabilities have a Common Vulnerability Scoring System version 4.0 score of 9.2 out of 10, placing them in the critical severity category.
If successfully exploited, the weaknesses could allow attackers to take control of affected servers, access sensitive information or disrupt online services.
The seriousness of the flaws is one reason cybersecurity authorities have urged organisations to act quickly rather than wait for signs of an actual attack.
Hackers have already attempted to exploit the flaws
The PHP2Shell vulnerabilities became a major concern after PHP developers disclosed the security weaknesses and released urgent fixes on October 21.
Singapore’s CSA issued an alert warning organisations about the potential impact and the need for immediate action.
The agency subsequently updated its advisory on October 23 with additional guidance for website owners, service providers, system administrators and cybersecurity teams.
The warning was not based solely on theoretical risks.
CSA said it was aware of widespread exploitation attempts targeting the vulnerabilities, as well as the development of multiple proof-of-concept exploits.
A proof-of-concept exploit is a demonstration showing how a security weakness can be used. Although such demonstrations can help security researchers understand and test vulnerabilities, they can also provide attackers with information that makes exploitation easier.
Cloudflare also reported millions of attempted exploitation requests following public disclosure of the flaws, according to reporting by Channel NewsAsia.
The international response demonstrated how quickly a newly disclosed software weakness can become a global cybersecurity concern.
Some organisations reportedly took precautionary measures, including temporarily taking websites offline, while developers and system administrators worked to install security updates.
For Singapore, the challenge was to ensure that government systems, critical infrastructure operators and private businesses responded before the vulnerabilities could be turned into successful attacks.
Why third-party vendors are part of the problem
One of the important issues raised in Parliament was the difficulty of identifying vulnerabilities in systems that organisations do not manage entirely themselves.
Many companies depend on external website developers, hosting providers, software vendors and IT service companies to maintain their digital operations.
A business may know which platform its website uses without knowing every software component running behind it.
For example, an organisation may operate a website built on WordPress while relying on a hosting provider or third-party developer to manage its server environment.
Even if the company does not directly maintain PHP, the programming language may still be installed and running on the infrastructure supporting its website.
This creates a potential blind spot.
A company might believe that its main website software is secure while overlooking an affected PHP installation or vulnerable component maintained by an external provider.
Tan said existing requirements should continue to be assessed to ensure that vulnerability-management responsibilities also cover systems maintained by third-party vendors.
The issue is especially important for organisations operating services that depend on multiple interconnected technology providers.
A weakness in one component can potentially create an entry point into a wider digital environment.
AI is making vulnerability discovery faster
Tan also highlighted the growing role of artificial intelligence in cybersecurity.
He warned that AI is accelerating the discovery of software vulnerabilities while increasing the potential speed and scale of cyberattacks.
This creates a difficult situation for organisations.
Traditionally, identifying a software weakness, understanding how it could be exploited and developing an effective attack could require considerable technical expertise and time.
AI-assisted tools may reduce some of those barriers by helping researchers and attackers analyse code, identify weaknesses and develop ways to test them.
The PHP2Shell vulnerabilities themselves were reportedly uncovered using AI, according to the software developers.
The same technological progress that helps security teams identify and repair weaknesses can also benefit malicious actors looking for opportunities to break into vulnerable systems.
That is why Tan stressed that organisations should monitor their systems for signs of compromise rather than assuming that installing a security update is the end of the process.
Patching closes known vulnerabilities, but organisations may also need to investigate whether attackers accessed their systems before the fixes were installed.
This includes checking server activity, reviewing unusual requests and examining signs of unauthorised access.
Singapore’s response includes support for critical infrastructure owners
The PHP2Shell incident comes amid broader efforts by Singapore to strengthen the cybersecurity of essential services.
Critical information infrastructure, commonly known as CII, refers to computer systems and networks that support services considered essential to the country.
These include sectors such as energy, water, banking and finance, healthcare, transport, infocommunications, media, security and emergency services, and government.
A successful cyberattack against these systems could have consequences beyond a single organisation.
For example, a serious disruption affecting a critical service could interfere with public access to essential facilities, business operations or important digital services.
Singapore has therefore been strengthening the requirements and support available to CII owners.
Earlier in 2026, the Government announced additional cybersecurity measures, including the selective sharing of classified threat intelligence and the provision of government-developed threat-detection tools to qualifying infrastructure operators.
The aim is to improve the ability of organisations to detect malicious activity and respond to sophisticated threats.
The Government has also emphasised that cybersecurity responsibilities should reach beyond technical departments.
Senior leaders and boards must understand the risks facing their organisations and ensure that appropriate resources are available to address them.
Related coverage: Singapore’s Digital Infrastructure Bill Sets New Rules for Data Centres and Cloud Providers.
What smaller businesses can do if they lack cybersecurity teams
The PHP vulnerabilities also raise concerns for small and medium-sized enterprises (SMEs), many of which do not have dedicated cybersecurity departments.
Dr Chen asked what practical assistance is available to smaller businesses that may struggle to determine whether their systems are affected and how to respond.
Tan encouraged SMEs to make use of government-backed support initiatives, including CSA’s SG Cyber Safe Programme.
The programme is designed to help Singapore organisations strengthen their cybersecurity practices and improve their ability to protect digital operations.
Tan also highlighted the Cybersecurity Health Plan service and the CISO-as-a-Service programme.
These initiatives can help businesses assess their existing security arrangements and identify areas requiring improvement.
He noted that some of the available initiatives provide government co-funding of up to 70 per cent, although the actual support depends on the specific programme and eligibility requirements.
Another measure highlighted by Tan is the upcoming Cyber Incident Helpline.
The service is intended to provide organisations experiencing cyber incidents with initial assistance, including incident triage, practical advice and referrals to relevant service providers and resources.
This could help businesses understand the immediate steps needed to contain an incident and begin recovery.
For SMEs that are unsure whether their websites or servers are affected by PHP2Shell, the immediate recommendation is to contact their IT teams, website developers or hosting providers.
They should specifically ask whether their systems use affected PHP versions and whether the necessary security updates have been installed.
What organisations should do immediately
Singapore’s CSA has advised organisations to identify systems running PHP and apply the relevant security updates as soon as possible.
Internet-facing systems should receive priority because they are accessible from outside an organisation’s internal network.
Businesses should also check systems managed by third parties, including hosting providers and external software vendors.
The recommended steps include:
1. Identify PHP installations. Organisations should determine whether PHP is installed on their web servers, applications or supporting infrastructure. They should not assume that they are unaffected simply because their main website does not visibly use PHP.
2. Apply security updates. Administrators should install the appropriate fixes released by PHP developers and verify that affected systems are running secure versions.
3. Prioritise internet-facing systems. Websites and services accessible through the public internet should be assessed and patched urgently.
4. Review third-party systems. Businesses should contact external IT providers, developers and hosting companies to confirm whether their infrastructure is affected and what action has been taken.
5. Look for signs of compromise. Organisations should investigate suspicious server activity and possible unauthorised access, particularly if systems remained vulnerable after public disclosure.
6. Use temporary safeguards when patching is delayed. Organisations unable to install updates immediately should follow official technical guidance to reduce exposure while arranging a permanent fix.
CSA has also published additional monitoring guidance to help organisations identify vulnerable installations and investigate possible exploitation attempts.
The agency has urged organisations not to delay action, particularly when systems are exposed to the internet.
The Bottom Line
Singapore has reported no evidence that the PHP2Shell vulnerabilities have been exploited in government or critical information infrastructure systems, but authorities are continuing to treat the threat seriously.
Tan Kiat How’s November 4 parliamentary response confirmed that CSA and GovTech worked with government agencies and critical infrastructure owners to identify affected systems and secure them. Alternative measures were introduced where immediate patching was not possible.
The wider concern is that the two PHP vulnerabilities could allow unauthenticated attackers to execute malicious code on affected servers, potentially exposing sensitive information and disrupting online services.
With exploitation attempts already reported internationally, businesses cannot afford to assume that their systems are safe simply because they have not experienced a visible cyberattack.
The warning is particularly important for SMEs and organisations that rely on third-party hosting providers, developers and software vendors.
Singapore’s response also reflects a larger shift in cybersecurity: as AI makes it easier to discover vulnerabilities, organisations must become faster at identifying weaknesses, applying fixes and detecting suspicious activity.
There may be no confirmed breach of Singapore’s government or critical infrastructure systems from PHP2Shell, but will businesses act before hackers find an opening — or only after their data and services are already at risk?
