MDDI's Response to PQ on Government Systems Exposed to Critical PHP Vulnerabilities Disclosed on 21 October 2026, Patching Timeline and Attempted Exploitations

Parliament Sitting on 4 November 2026

Question for Written Answer

36. Mr Alex Yeo asked the Minister for Digital Development and Information in respect of the critical PHP vulnerabilities disclosed on 21 October 2026 (a) whether any Government internet-facing systems were exposed to these vulnerabilities at the time of disclosure; (b) how long it took for all affected systems to be patched or otherwise secured; and (c) whether any attempted exploitation against Government systems was detected during this period.

Answer

Following the disclosure of these vulnerabilities, the Government Technology Agency of Singapore (GovTech) and the Cyber Security Agency of Singapore (CSA) worked quickly with Government agencies and Critical Information Infrastructure (CII) owners to identify and secure the affected systems. Where immediate patching was not possible, alternative measures were put in place.

While there’s no evidence of these vulnerabilities being exploited in Government or CII systems, we remain vigilant. We will continue to assess if established requirements for managing vulnerabilities are sufficient. This includes systems maintained by third party vendors.

Artificial intelligence (AI) is accelerating the discovery of vulnerabilities and increasing the speed and scale of cyber attacks. Organisations can and should monitor their systems for signs of compromise. They can refer to CSA’s resources for guidance, including how to respond effectively when compromised.