Politics news and discussion on TalkFuse.
No evidence PHP flaws exploited in government, critical infrastructure systems: Tan Kiat How
Singapore has found no evidence that the PHP2Shell vulnerabilities were exploited in government systems or critical information infrastructure, Senior Minister of State Tan Kiat How told parliament. Authorities worked with agencies and infrastructure owners to identify and secure affected systems after the flaws were disclosed, and say they will keep monitoring for signs of compromise.
The flaws, disclosed on 21 October, affect all PHP versions and could let attackers run code remotely without authentication; PHP runs about 70 per cent of the world’s websites. A security fix was released the same day, and alternative safeguards were used where immediate patching was not possible. Tan said smaller firms can access government-supported cyber security measures with up to 70 per cent co-funding, and a cyber incident helpline for companies is planned.
In short
- No evidence PHP2Shell was exploited in Singapore’s government or critical infrastructure.
- Authorities secured affected systems and used alternatives where patching was delayed.
- Small firms can get up to 70 per cent co-funding for cyber security measures.
Explained simply
PHP is software used to build and run many websites. A flaw in PHP can put websites and the computer systems behind them at risk; the PHP2Shell flaws could allow someone to run code on an affected system without signing in.
Singapore’s government agencies and owners of critical information infrastructure are responsible for securing systems that support essential services. Tan Kiat How is the senior minister of state who told parliament about the checks, while the developers of PHP issued a fix for the flaws.
The issue matters because attacks on government or essential services could disrupt public services or expose information. Smaller firms may also be affected, and Singapore offers support to help them improve their cyber security.