No evidence PHP flaws exploited in government, critical infrastructure systems: Tan Kiat How

SINGAPORE: There is no evidence that PHP vulnerabilities were exploited in government systems or Singapore's critical information infrastructure (CII), said Senior Minister of State for Health Tan Kiat How in parliament on Wednesday (Nov 4).

This follows the Oct 21 disclosure of critical flaws in PHP, a programming language that runs about 70 per cent of the world's websites, leading Singapore authorities to urge organisations to patch gaps immediately amid cyberattack threat.

Following the disclosure, the Government Technology Agency (GovTech) and Cyber Security Agency of Singapore (CSA) worked with government agencies and CII owners to identify and secure affected systems, said Mr Tan in response to parliamentary questions.

"Where immediate patching was not possible, alternative measures were put in place," he said.

Asked if any compromises or service disruptions had been detected, Mr Tan said there has been no evidence of the two flaws, collectively known as PHP2Shell, being exploited in government or CII systems. 

The authorities will remain vigilant and continue assessing whether existing requirements for managing vulnerabilities were sufficient, he added – including systems maintained by third-party vendors.

Mr Tan also said artificial intelligence (AI) was accelerating the discovery of vulnerabilities while increasing the speed and scale of cyberattacks.

Organisations should monitor their systems for signs of compromise, he added, noting that they can refer to CSA's resources for guidance on how to respond if they are affected.

In response to a supplementary question from Member of Parliament Charlene Chen (PAP-Tampines) on practical help available to smaller businesses without dedicated cybersecurity teams, Mr Tan said the government recognised that they may not have the same resources as larger organisations.

He pointed to CSA's SG Cyber Safe programme and other government-supported initiatives, saying companies can receive up to 70 per cent co-funding for many of these measures.

There is also support for companies to engage professional cybersecurity firms to carry out vulnerability testing, he said.

Mr Tan added that the government had recently announced plans for a cyber incident helpline for companies, particularly small and medium enterprises, that may not know what to do or who to turn to after a breach.

"We will aim to launch a helpline as soon as we can," he said.

RISKS POSED BY PHP2SHELL

The PHP2Shell vulnerabilities affect all versions of PHP, said a CSA security alert issued on Oct 21. 

They had remained hidden for more than a decade before being uncovered with the help of artificial intelligence.

The flaws could allow attackers to remotely execute code on vulnerable systems without authentication, potentially giving them control of affected web servers.

CSA said there had been reports of widespread exploitation attempts, as well as the development of multiple proof-of-concept exploits.

A security fix was subsequently released also on Oct 21, with organisations using PHP urged to update their systems promptly.