Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Critical Vulnerabilities in PHP

21 October 2026

A critical PHP security update will be released on 21 Oct 2026, 22:00 SGT. Patch immediately, prioritising internet-facing systems.

Background

PHP is a widely used scripting language in many websites and web applications. The PHP security team has announced an upcoming critical security release to address two vulnerabilities with CVSS v4.0 scores of 9.2 out of 10. The release is scheduled for 21 October 2026, at 22:00 SGT.

Recommendations

Organisations are advised to prepare for this security release by identifying systems running any version of PHP, and applying the security updates as soon as they become available, with a priority on internet-facing systems. Organisations should further check whether PHP is installed on their web servers, including where it may be used by third-party applications or components, even if their primary websites do not use PHP.

Organisations should also monitor PHP's official guidance available at: https://www.php.net/archive/2026.php#2026-10-20-1 (opens in new tab)

This page will be updated when more information about the vulnerabilities is available.