Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Ministry of Digital Development and Information
Parliament

MDDI's Response to PQ on Disclosed Critical PHP Software Vulnerabilities

4 November 2026

Parliament Sitting on 4 November 2026

Question for Oral Answer

36. Alex Yeo asked the Minister for Digital Development and Information in respect of the critical PHP vulnerabilities disclosed on 21 October 2026 (a) whether any Government internet-facing systems were exposed to these vulnerabilities at the time of disclosure; (b) how long it took for all affected systems to be patched or otherwise secured; and (c) whether any attempted exploitation against Government systems was detected during this period.

17. Charlene Chen asked the Minister for Digital Development and Information in light of the recently disclosed critical PHP software vulnerabilities (a) whether Government systems and critical information infrastructure have been assessed for exposure; (b) whether any compromises or service disruptions have been detected; and (c) how the Government ensures timely identification and remediation of vulnerabilities in widely used software, including third-party applications.

3397. Cassandra Lee asked the Minister for Digital Development and Information in light of the critical PHP2Shell vulnerabilities disclosed on 21 October 2026 allowing unauthenticated remote code execution (a) whether the Government has inventoried and patched its systems running PHP; and (b) what steps are taken for Government systems on end-of-life PHP versions that no longer receive official security updates.

3398. Cassandra Lee asked the Minister for Digital Development and Information in light of PHP2Shell vulnerabilities (a) whether the Government has required or verified that third-party service providers maintaining systems on behalf of Government agencies have identified and patched all PHP components, including those embedded in third-party applications; and (b) what assurances are in place for systems built or maintained externally.

Answer

  1. Mr Speaker, my reply will address the questions raised by Members of Parliament Mr Alex Yeo and Ms Charlene Chen in today’s Order Paper, as well as questions by MP Cassandra Lee filed for a subsequent sitting, relating to PHP2Shell vulnerabilities.

  2. Following the disclosure of these vulnerabilities, GovTech and CSA worked quickly with government agencies and Critical Information Infrastructure (CII) owners to identify and secure the affected systems. Where immediate patching was not possible, alternative measures were put in place.

  3. While there’s no evidence of these vulnerabilities being exploited in Government or CII systems, we must remain vigilant. We will continue to assess if established requirements for managing vulnerabilities are sufficient. This includes systems maintained by third-party vendors.  

  4. Artificial intelligence (AI) is accelerating the discovery of vulnerabilities and increasing the speed and scale of cyber attacks. Organisations can and should monitor their systems for signs of compromise.  They can refer to CSA’s resources for guidance, including how to respond effectively when compromised.