No evidence PHP flaws exploited in government, critical infrastructure systems: Tan Kiat How
Organisations should continue to monitor their systems for signs of compromise, says the Senior Minister of State for Health.
FILE PHOTO: A man holds a laptop computer as cyber code is projected on him in this illustration picture taken on May 13, 2017. REUTERS/Kacper Pempel
New: You can now listen to articles.
This audio is generated by an AI tool.
Read a summary of this article on FAST.
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST
Tap here to return to FAST
FAST
SINGAPORE: There is no evidence that PHP vulnerabilities were exploited in government systems or Singapore’s critical information infrastructure (CII), said Senior Minister of State for Health Tan Kiat How in parliament on Wednesday (Nov 4).
This follows the Oct 21 disclosure of critical flaws in PHP, a programming language that runs about 70 per cent of the world’s websites, leading Singapore authorities to urge organisations to patch gaps immediately amid cyberattack threat.
Following the disclosure, the Government Technology Agency (GovTech) and Cyber Security Agency of Singapore (CSA) worked with government agencies and CII owners to identify and secure affected systems, said Mr Tan in response to parliamentary questions.
“Where immediate patching was not possible, alternative measures were put in place,” he said.
Asked if any compromises or service disruptions had been detected, Mr Tan said there has been no evidence of the two flaws, collectively known as PHP2Shell, being exploited in government or CII systems.
The authorities will remain vigilant and continue assessing whether existing requirements for managing vulnerabilities were sufficient, he added – including systems maintained by third-party vendors.
Mr Tan also said artificial intelligence (AI) was accelerating the discovery of vulnerabilities while increasing the speed and scale of cyberattacks.
Organisations should monitor their systems for signs of compromise, he added, noting that they can refer to CSA’s resources for guidance on how to respond if they are affected.
Guess Word
Crack the word, one row at a time
Buzzword
Create words using the given letters
Mini Sudoku
Tiny puzzle, mighty brain teaser
Mini Crossword
Small grid, big challenge
Word Search
Spot as many words as you can
In response to a supplementary question from Member of Parliament Charlene Chen (PAP-Tampines) on practical help available to smaller businesses without dedicated cybersecurity teams, Mr Tan said the government recognised that they may not have the same resources as larger organisations.
He pointed to CSA’s SG Cyber Safe programme and other government-supported initiatives, saying companies can receive up to 70 per cent co-funding for many of these measures.
There is also support for companies to engage professional cybersecurity firms to carry out vulnerability testing, he said.
Mr Tan added that the government had recently announced plans for a cyber incident helpline for companies, particularly small and medium enterprises, that may not know what to do or who to turn to after a breach.
“We will aim to launch a helpline as soon as we can,” he said.
RISKS POSED BY PHP2SHELL
The PHP2Shell vulnerabilities affect all versions of PHP, said a CSA security alert issued on Oct 21.
They had remained hidden for more than a decade before being uncovered with the help of artificial intelligence.
The flaws could allow attackers to remotely execute code on vulnerable systems without authentication, potentially giving them control of affected web servers.
CSA said there had been reports of widespread exploitation attempts, as well as the development of multiple proof-of-concept exploits.
A security fix was subsequently released also on Oct 21, with organisations using PHP urged to update their systems promptly.
Source: CNA/jw/ml
Sign up for our newsletters
Get the CNA app
Stay updated with notifications for breaking news and our best stories
Get WhatsApp alerts
Join our channel for the top reads for the day on your preferred chat app
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST
Tap here to return to FAST
FAST
