Singapore’s Cyber Security Agency (CSA) has called for immediate checks and fixes on PHP systems after reports of widespread attack attempts raised the risk of unauthorized code execution on web servers.
In an alert dated Oct. 21 and updated Oct. 22, the agency identified CVE-2026-109618, involving out-of-memory handling, and CVE-2026-109619, a use-after-free flaw. It rated both 9.2 out of 10 under version 4.0 of the Common Vulnerability Scoring System (CVSS) and said all PHP versions are affected. Successful exploitation could expose data or disrupt services, CSA said.
The PHP project issued fixes Oct. 21 for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Project updates have ended for PHP 8.1 and older, although some software distributors and long-term support vendors may supply backported fixes. The project also posted source patches for versions 7.4, 8.0 and 8.1.
Web-facing PHP installations may be exposed, according to the project’s advisory. It lists several configurations, including PHP-FPM, php-cgi and Apache’s mod_php, which it describes as the highest-risk setup. CSA urged administrators to inventory PHP across their systems, check third-party applications and components, and give priority to servers reachable from the internet.
Channel NewsAsia reported that CSA Commissioner of Cybersecurity and chief executive Gwenda Fong warned that small and midsize businesses using outside IT or hosting providers may not know their systems are exposed. The CSA alert separately advises checking third-party components.
Cloudflare said it detected attack traffic targeting its customers and deployed web application firewall protections, while still urging customers to install the PHP updates.
The PHP Foundation said the memory-handling flaw emerged during work on a separate issue in 2024. It said efforts to address the problem paused before resuming over several months, and described the delay as “a structural failure,” citing its security team’s decision process and limited resources.
CSA’s alert describes exploitation attempts and proof-of-concept exploits, but does not confirm a breach at a Singapore organization. The agency advised administrators to keep following PHP’s official guidance.
