Governments and companies race to patch critical PHP flaws as hacking attempts surge

Summary

Governments and companies around the world are racing to patch two critical flaws in PHP, a widely used web programming language that powers many websites and online services. The flaws could let attackers execute code remotely, take control of web servers, steal data or disrupt services without login credentials. Hong Kong's Digital Policy Office said on Thursday that it had issued a security alert to all bureaus, departments and public organisations, requiring an immediate and comprehensive review of whether their information systems were affected. Singapore's Commissioner of Cybersecurity, Gwenda Fong, said on Thursday that the threat is immediate and urged organisations to fix the flaws quickly, amid reports of widespread attempts by hackers to exploit them. RTÉ reported that experts had seen a surge in hacking attempts following the flaws' disclosure.

Timeline

1. South China Morning Post

   22 Oct 2026, 06:37 UTCSource ↗

   Reports that Hong Kong's Digital Policy Office said on Thursday it had issued a security alert over two critical PHP flaws to all bureaus, departments and public organisations, requiring an immediate and comprehensive review of whether their information systems were affected.

2. RTÉ

   22 Oct 2026, 09:53 UTCSource ↗

   Reports that companies and governments around the world are racing to patch vulnerabilities in PHP, and that experts reported a surge in hacking attempts following their disclosure.

3. South China Morning Post

   22 Oct 2026, 13:58 UTCSource ↗

   Reports that Singapore's Commissioner of Cybersecurity, Gwenda Fong, said on Thursday that organisations must immediately fix two critical PHP flaws that could let attackers take control of web servers, steal data or disrupt services, amid reports of widespread hacking attempts.