新加坡的相关机构已被敦促立即修复一种广泛使用的编程语言中的两个关键安全漏洞，因为有报道称黑客正在试图利用这些漏洞进行攻击。
Organisations in Singapore have been urged to immediately fix two critical security flaws in a widely used programming language amid reports of widespread attempts by hackers to exploit the vulnerabilities.
根据新加坡网络安全专员Gwenda Fong周四的说法，这些存在于PHP中的漏洞（PHP是许多网站和在线服务的核心编程语言）可能使攻击者无需任何认证信息即可控制Web服务器、窃取数据或干扰服务运行。
The flaws in PHP, which powers many websites and online services, could allow attackers to take control of web servers, steal data or disrupt services without needing credentials, Singapore’s Commissioner of Cybersecurity Gwenda Fong said on Thursday.
“这一威胁迫在眉睫，”同时担任新加坡网络安全局（CSA）首席执行官的Fong在社交媒体上写道。她补充说，针对这些漏洞的攻击工具已经存在，相应的安全补丁已于周三发布。
“The threat is immediate,” Fong, who is also CEO of the Cyber Security Agency of Singapore (CSA), said in a social media post. Working exploits have already been demonstrated and security patches were released on Wednesday, she added.
根据新加坡网络安全局周三发布的警报，这两个漏洞（统称为PHP2Shell，CVE-2026-109618和CVE-2026-109619）影响所有版本的PHP。该机构表示，已有大量关于黑客尝试利用这些漏洞的报道，同时也有多个攻击工具（即“概念验证攻击工具”）被开发出来。
The vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), affect all versions of PHP, according to a CSA security alert issued on Wednesday. The agency said there had been reports of widespread exploitation attempts, as well as the development of multiple proof-of-concept exploits.
云计算服务公司Cloudflare的首席执行官Matthew Prince在周三晚间的社交媒体帖子中表示，自这些漏洞被公开披露后，该公司记录到了数百万次攻击尝试。
Cloud services firm Cloudflare recorded millions of attempts to exploit the vulnerabilities following their public disclosure, its CEO Matthew Prince said in a social media post late on Wednesday.
由于这些漏洞的存在，全球各地的网站运营商都采取了预防措施；欧洲及其他地区的政府网站也在周三被迫暂时关闭服务。
The flaws have also prompted website operators around the world to take precautionary measures, with government websites in Europe and elsewhere going offline on Wednesday.
PHP开发者们在周三发布了紧急安全补丁，以修复这些多年来一直未被发现的漏洞。他们呼吁用户立即更新自己的PHP软件。
PHP developers released urgent security fixes on Wednesday for vulnerabilities that had gone undetected for years before being uncovered using artificial intelligence, urging users to update immediately.
Fong警告称，许多组织，尤其是那些依赖外部IT供应商或托管服务提供商的小型和中型企业，可能尚未意识到自己的系统存在安全隐患。
Fong warned that many organisations, particularly small- and medium-sized enterprises that rely on external IT vendors or hosting providers, may not realise their systems are vulnerable.
PHP被广泛应用于各种网站中，包括基于WordPress、Drupal和Joomla等平台的网站。
PHP is widely used in websites, including those built on platforms such as WordPress, Drupal and Joomla.
“我对新加坡所有组织的信息很简单：不要等待，”Fong强调道。
“My message to every organisation in Singapore is simple: do not wait,” she said.
运营网站或在线服务的机构应检查其系统是否使用了受影响的PHP版本，包括由第三方供应商管理的系统。
Organisations operating websites or online services should check whether their systems use affected versions of PHP, including those managed by third-party vendors.
方补充说，他们应立即安装安全补丁，优先处理可从互联网访问的系统，并调查其系统是否可能已被入侵。
They should apply security patches immediately, prioritising systems accessible from the internet and investigate whether their systems may already have been compromised, Fong added.
对于不确定是否受到影响的机构，应联系其IT团队、网站开发人员或托管服务提供商。
Those unsure whether they are affected should contact their IT teams, website developers or hosting providers.
新加坡网络安全局表示，正在紧急与政府机构、关键信息基础设施所有者、大型企业和行业合作伙伴合作，以加快补丁安装。
CSA said it was working urgently with government agencies, critical information infrastructure owners, major enterprises and industry partners to accelerate patching.
该局还通过商业协会、网络安全服务提供商和技术合作伙伴联系各方，帮助规模较小的机构应对这些漏洞。
It is also reaching out through business associations, cybersecurity service providers and technology partners to help smaller organisations address the vulnerabilities.
“现在的首要任务是在攻击者利用漏洞之前，识别并修补存在漏洞的系统，”方说。
“The priority now is to identify and patch vulnerable systems before attackers can exploit them,” Fong said.
“网络安全是共同的责任。现在迅速采取行动，可以防止漏洞演变成严重事件。”《海峡时报》报道
“Cybersecurity is a shared responsibility. Acting quickly now can prevent a vulnerability from becoming a serious incident.”By CNA