Singapore firms urged to act urgently over critical PHP vulnerabilities
Critical vulnerabilities have been found in the widely-used PHP programming language, with its developers releasing urgent security patches on Oct 21.The vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), have reportedly been lurking in the programming language for years before they were uncovered using artificial intelligence, according to the software's developers.These could allow attackers to exploit affected systems without needing login credentials, potentially taking control of web servers, stealing data or disrupting services.PHP is a programming language used to power websites and online services. It is widely used, including in websites built on platforms such as WordPress, Drupal and Joomla.When a visitor loads a page, a server running PHP assembles the content and sends it to the browser. It is free, open-source software maintained by volunteers.With tech firms warning that some hackers were already exploiting the flaws and government agencies across Europe taking sites offline as a precaution, the Cyber Security Agency of Singapore (CSA) on Thursday (Oct 22) issued an urgent advisory.