新加坡：新加坡卫生部高级国务部长陈奇劲周三（11月4日）在议会表示，没有证据表明PHP漏洞已在政府系统或新加坡关键信息基础设施（CII）中被利用。
SINGAPORE: There is no evidence that PHP vulnerabilities were exploited in government systems or Singapore's critical information infrastructure (CII), said Senior Minister of State for Health Tan Kiat How in parliament on Wednesday (Nov 4).
此举是在10月21日披露PHP编程语言中的严重缺陷之后发生的。PHP运行着全球约70%的网站，新加坡当局在网络攻击威胁下敦促各组织立即修补漏洞。陈奇劲在回应议员提问时表示，披露之后，政府科技局（GovTech）和新加坡网络安全局（CSA）与政府机构及CII所有者合作，识别并保护受影响的系统。“在无法立即修补的情况下，已采取替代措施，”他说。
This follows the Oct 21 disclosure of critical flaws in PHP, a programming language that runs about 70 per cent of the world's websites, leading Singapore authorities to urge organisations to patch gaps immediately amid cyberattack threat Following the disclosure, the Government Technology Agency (GovTech) and Cyber Security Agency of Singapore (CSA) worked with government agencies and CII owners to identify and secure affected systems, said Mr Tan in response to parliamentary questions. "Where immediate patching was not possible, alternative measures were put in place," he said.
被问及是否发现任何被攻破或服务中断的情况，陈奇劲表示，没有证据表明这两个统称为PHP2Shell的漏洞在政府或CII系统中被利用。
Asked if any compromises or service disruptions had been detected, Mr Tan said there has been no evidence of the two flaws, collectively known as PHP2Shell, being exploited in government or CII systems.
他补充说，当局将保持警惕，并继续评估现有漏洞管理要求是否足够，包括由第三方供应商维护的系统。
The authorities will remain vigilant and continue assessing whether existing requirements for managing vulnerabilities were sufficient, he added – including systems maintained by third-party vendors.
陈奇劲还表示，人工智能（AI）正在加速漏洞的发现，同时增加网络攻击的速度和规模。
Mr Tan also said artificial intelligence (AI) was accelerating the discovery of vulnerabilities while increasing the speed and scale of cyberattacks.
他补充说，各组织应监控其系统是否有被攻破的迹象，并指出它们可以参考CSA的资源，了解如果受到影响应如何应对。
Organisations should monitor their systems for signs of compromise, he added, noting that they can refer to CSA's resources for guidance on how to respond if they are affected.
针对议员陈佩琪（人民行动党-淡滨尼）关于没有专门网络安全团队的中小企业可获得哪些实际帮助的补充提问，陈奇劲表示，政府认识到这些企业可能不像大型组织那样拥有相同的资源。
In response to a supplementary question from Member of Parliament Charlene Chen (PAP-Tampines) on practical help available to smaller businesses without dedicated cybersecurity teams, Mr Tan said the government recognised that they may not have the same resources as larger organisations.
他指出，CSA的“SG Cyber Safe”计划及其他政府支持的举措，企业可为其中许多措施获得最高70%的共同资助。他还说，还有支持企业聘请专业网络安全公司开展漏洞测试。
He pointed to CSA's SG Cyber Safe programme and other government-supported initiatives, saying companies can receive up to 70 per cent co-funding for many of these measures. There is also support for companies to engage professional cybersecurity firms to carry out vulnerability testing, he said.
陈先生补充说，政府最近宣布计划为企业设立网络事件热线，特别是那些在遭遇入侵后可能不知道该怎么办或该向谁求助的中小企业。“我们将力求尽快推出热线，”他说。
Mr Tan added that the government had recently announced plans for a cyber incident helpline for companies, particularly small and medium enterprises, that may not know what to do or who to turn to after a breach. "We will aim to launch a helpline as soon as we can," he said.
PHP2SHELL带来的风险 CSA于10月21日发布的一份安全警报称，PHP2Shell漏洞影响所有版本的PHP。这些漏洞隐藏了十余年，在人工智能的帮助下才被发现。
RISKS POSED BY PHP2SHELL The PHP2Shell vulnerabilities affect all versions of PHP, said a CSA security alert issued on Oct 21. They had remained hidden for more than a decade before being uncovered with the help of artificial intelligence.
这些缺陷可能允许攻击者在易受攻击的系统上远程执行代码，且无需身份验证，从而可能使他们控制受影响的Web服务器。
The flaws could allow attackers to remotely execute code on vulnerable systems without authentication, potentially giving them control of affected web servers.
CSA表示，已有广泛利用尝试的报告，以及多个概念验证漏洞利用程序的开发。
CSA said there had been reports of widespread exploitation attempts, as well as the development of multiple proof-of-concept exploits.
随后，安全修复程序也于10月21日发布，CSA敦促使用PHP的组织尽快更新系统。
A security fix was subsequently released also on Oct 21, with organisations using PHP urged to update their systems promptly.