Singapore Warns Companies to Fix Dangerous Flaws in Popular Web Software

Singapore's top cybersecurity official is urging every company and organisation in the country to act fast to fix serious security flaws in PHP, a popular programming language used to run a huge part of the internet. Gwenda Fong, the Commissioner of Cybersecurity, made the warning on October 22 through a post on LinkedIn. She said the threat is real and immediate, and organisations should not wait before taking action.

The flaws in PHP were discovered on October 21, when cybersecurity agencies around the world sounded the alarm. Developers who work on PHP quickly released fixes, also called 'patches,' on the same day. What made these discoveries unusual is that artificial intelligence tools helped find the weaknesses, which had been hiding in the software for years without anyone knowing.

After the warnings came out, governments and companies around the world rushed to shut down websites and apps to protect themselves. They were worried that hackers might try to break into their systems using these flaws. The situation moved very quickly, and security teams had to work around the clock.

Fong said that many organisations, especially small and medium-sized businesses, might not even know their systems are at risk. These smaller businesses often rely on outside IT companies or website hosting services to manage their technology. Because of this, their websites could be running the flawed software without the owners ever realising it.

Fong, who is also the chief executive of the Cyber Security Agency of Singapore (CSA), outlined clear steps for organisations to follow. First, they should check whether their websites or online services — including those managed by outside vendors — are using the affected versions of PHP. Next, they should apply patches right away, starting with any systems that are visible and accessible on the internet.

Organisations should also look for any signs that their systems may have already been broken into. If they are unsure whether they are affected, Fong advised them to contact their IT team, website developer, or hosting provider straight away. She reminded everyone that cybersecurity is everyone's responsibility, not just that of tech experts.

The CSA said that the flaws affect all versions of PHP, which is a serious concern because so many websites use this language. While no Singapore websites are known to have been taken down by hackers yet, the agency warned that there have already been many attempts by attackers to exploit these weaknesses around the world. Security researchers have also created test programs that show how the flaws could be used, making it easier for hackers to try attacks.

GovTech, the agency that runs Singapore's digital government services, said it is working closely with other government agencies to put protective measures in place. It confirmed that, so far, no government systems appear to have been compromised. However, GovTech said that some services might be taken offline temporarily as a safety measure while they are being fixed.

A cybersecurity expert from Belgium added more concern to the situation. Madeline Lawrence, co-founder of a firm called Aikido Security, noted that details about the flaws became public before the fixes were fully ready. She said that attacks had already been reported by the time patches were released, highlighting why organisations must update their software as quickly as possible.