PHP, created in 1994, helps run an estimated 70 per cent of the world’s websites, web applications and digital service platforms.
A fix was released Wednesday, with the PHP Foundation telling the tech departments of companies and organisations: “If you run PHP, it is imperative that you update now.”
These vulnerabilities were discovered after security firms said they used Artificial Intelligence to find vulnerabilities hidden in PHP, forcing many websites to go dark as developers work to protect their underlying code from hacks.
The Ministry of ICT also joined the bandwagon on Wednesday night, saying it will heighten necessary security measures to restrict exposure of the confidentiality of Government information systems and online public services.
“Administrators should verify the applicable fixes and affected versions against official PHP guidance and vendor advisories before deployment,” the Ministry said in a statement.
The PHP security team has announced that security updates are scheduled for release on October 21, 2026.
The Ministry has also urged institutions to review and strengthen their web application firewall rules, access controls and other applicable security controls.
“Temporary protective measures should not be treated as a substitute for applying the official security updates,” the statement cautioned.
It also plans to identify vulnerable systems, maintain high monitoring and engage third parties (hosting providers, software developers).
“The ICT Authority shall coordinate technical guidance and support to Government institutions in identifying potentially affected systems, facilitating remediation and monitoring implementation of the recommended measures,” the Ministry said.
“All Government institutions are required to treat this advisory as urgent and ensure that the necessary technical and administrative measures are undertaken to safeguard Government websites.”
Remediation shall be executed according to exposure and service criticality, and unresolved high-risk exposures shall be escalated through the mentioned channels.
Cutting-edge AI models, such as those from US giants OpenAI and Google, were used by Wiz and other groups to uncover PHP’s weak spots in August.
Dubbed “PHP2SHELL,” these highly severe vulnerabilities were rated 9.2 out of 10 in danger and have forced governments and tech giants worldwide to scramble to patch servers.
