The vulnerabilities resided in the software for years until they were uncovered by AI tools
[SINGAPORE] Organisations in Singapore should act now to address critical vulnerabilities in PHP, a programming language that powers a large share of the internet, said Singapore’s Commissioner of Cybersecurity Gwenda Fong on Oct 22.
Her comment on LinkedIn came after cybersecurity agencies across the world warned about two critical vulnerabilities discovered in PHP on Oct 21.
PHP developers released urgent fixes on Oct 21 for vulnerabilities that had resided in the software for years until they were uncovered by artificial intelligence tools.
These warnings prompted governments and companies worldwide to shut down websites and apps as they raced to protect themselves from potential cyberattacks.
“My message to every organisation in Singapore is simple: Do not wait,” said Fong, who is also chief executive of the Cyber Security Agency of Singapore (CSA).
She said many organisations, especially small and medium-sized enterprises that rely on external IT vendors or hosting providers, may not realise that their systems are affected. But she said the threat is immediate.
The Business Times turns 50
Five decades of milestones and moments that shaped Singapore’s success story - told through our headlines.
Explore BT50
“CSA is working urgently with government agencies, critical information infrastructure owners, major enterprises and industry partners to accelerate patching. We are also reaching out through business associations, cybersecurity service providers and technology partners to help smaller organisations take action,” she said.
Fong said those that operate websites or online services should check whether their systems, including those managed by third-party vendors, use affected versions of PHP.
They should also patch immediately, prioritising internet-facing systems, and investigate whether there are signs that their systems may already have been compromised.
SEE ALSO
“If you are unsure whether your organisation is affected, contact your IT team, website developer or hosting provider today,” Fong added.
“Cybersecurity is a shared responsibility. Acting quickly now can prevent a vulnerability from becoming a serious incident.”
She referred those who require technical guidance and updates to CSA’s SingCERT alert.
On Oct 21, CSA said the exposed vulnerabilities affect all versions of the scripting language.
Even though there are no known cases of websites here taken down by hackers, CSA said: “There have been reports of widespread exploitation attempts targeting these vulnerabilities, as well as the development of multiple proof-of-concept exploits.”
“There is currently no indication that any government systems have been compromised as a result of these vulnerabilities,” said GovTech.
“Where necessary, affected services may be temporarily taken offline to facilitate remediation. Such measures are precautionary and do not indicate that the systems have been compromised.”
A Reuters report quoted Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, as saying: “Details of these flaws became public before fixes were ready, and attacks have since been reported.” THE STRAITS TIMES