Hansard Explorer

Dr Charlene Chen asked the Minister for Digital Development and Information in light of the recently disclosed critical PHP software vulnerabilities (a) whether Government systems and critical information infrastructure have been assessed for exposure; (b) whether any compromises or service disruptions have been detected; and (c) how the Government ens ures timely identification and remediation of vulnerabilities in widely used software, including third-party applications.

The Senior Minister of State for Digital Development and Information (Mr Tan Kiat How) (for the Minister for Digital Development and Information): Sir, my reply will address the questions filed by Members Mr Alex Yeo and Dr Charlene Chen in today's Order Paper, as well as questions by Member Ms Cassandra Lee1,2 filed for a subsequent Sitting, relating to PHP2Shell vulnerabilities.

Following the disclosure of these vulnerabilities, the Government Technology Agency of Singapore (GovTech) and the Cyber Security Agency of Singapore (CSA) worked quickly with Government agencies and critical information infrastructure (CII) owners to identify and secure the affected systems. Where immediate patching was not possible, alternative measures were put in place.

While there is no evidence of these vulnerabilities being exploited in Government or CII systems, we remain vigilant. We will continue to assess if established requirements for managing vulnerabilities are sufficient. This includes systems maintained by third party vendors.

Artificial intelligence (AI) is accelerating the discovery of vulnerabilities and increasing the speed and scale of cyber attacks. Organisations can and should monitor their systems for signs of compromise. They can refer to CSA's resources for guidance, including how to respond effectively when compromised.

Mr Speaker: Dr Chen.

Dr Charlene Chen (Tampines): Mr Speaker, the recent PHP2Shell vulnerabilities remind us that cyber threats are real. A single software weakness can impact Government's systems and businesses alike, potentially disrupting critical services and exposing consumers' sensitive data. I have two supplementary questions.

Number one: how does the Government ensure that businesses holding sensitive personal data take timely action when serious security vulnerabilities are discovered rather than waiting until a breach occurs?

Number two: for smaller businesses that may not have dedicated cybersecurity teams, what practical assistance is available to help them identify whether they are affected and address these vulnerabilities quickly?

Mr Tan Kiat How: Sir, I thank the Member for the two supplementary questions. It is a timely and important reminder that we should take cybersecurity threats seriously, including for our small and medium enterprises (SMEs) or smaller organisations.

With AI expediting or accelerating the discovery of vulnerabilities, bad actors can use these vulnerabilities to compromise our systems and ultimately, destroy the trust between an organisation and its clients and its customers. You can imagine that there is a loss of personal sensitive information or severe disruption in very essential services that the company provides to its clients.

So, this is a serious issue, and organisations, management and leadership of these organisations must take these risks seriously.

I agree with the Member that businesses should not wait for a data breach before addressing known security vulnerabilities. Businesses and organisations can refer to advisories and guidelines issued by organisations, Government agencies like Personal Data Protection Commission (PDPC) as well as CSA, which puts out guidelines, advisories on a regular basis, especially for serious vulnerabilities and how to mitigate against those vulnerabilities.

For smaller businesses, we acknowledge and recognise that they may not have dedicated cybersecurity teams and may not have the resources to do what larger organisations can do. So, CSA's SG Cyber Safe Programme and other Government-supported programmes are intended to support our SMEs to take the necessary steps to protect themselves. And there is Government support of up to 70% of co-funding for many of these initiatives.

So, I encourage companies, especially SMEs to make full use of all the different support, initiatives and programmes under the various Government agencies, including CSA's SG Cyber Safe Programme.

There is also a CISO-as-a-Service (CISOaaS) programme that has been rolled out, where there is support for companies to get professional cybersecurity service providers to do vulnerability assessment and penetration testing to identify vulnerabilities in their systems. So, please make full use of that.

We have also recently announced that we are going to set up a Cyber Incident Helpline, so, suppose something bad happens, a breach happens and companies, especially SMEs, do not know what to do, do not know who turn to, they can call the helpline to get support. We will aim to launch the helpline as soon as we can.

Mr Speaker: Ms Cassandra Lee.

Ms Cassandra Lee (West Coast-Jurong West): Thank you, Mr Speaker. Can I just ask the Senior Minister of State whether the Government has investigated as to any affected systems that were compromised before October 2026 and how far back does that investigation go?

Secondly, I would also like to ask the Senior Minister of State whether the Government relies on service providers' self-certification that systems have been patched or does it independently verify and scan to ensure that the necessary patches have been done? Is there a contractual deadline to which these critical vulnerabilities must be remediated in relation to Government's systems?

Mr Tan Kiat How: I thank the Member for her two questions. I will take them in turn. On the first one about whether we have discovered any exploitation or vulnerabilities, I would just like to reiterate there has been no evidence of successful exploitation of the PHP2Shell vulnerabilities in Government or CII systems to date.

The Government takes a multi-layered approach to detecting cyber threats. Following the disclosure of the PHP2Shell vulnerabilities, the Government conducted retrospective checks for indications of earlier compromise.

As not all compromises may be detected through retrospective reviews, continuous monitoring for suspicious or malicious cyber activity is critical. And to date, based on the information available to us, there has been no evidence of successful exploitation of these vulnerabilities in Government or CII systems.

On the second question, our greater priority in Government is essential Government services and CII systems. And we are working very closely with the system owners, the CII owners to make sure those vulnerabilities are patched as soon as possible; and where remediation is not feasible at this point in time, that the CII owners and system owners take appropriate actions to safeguard the systems. So, this is something that we are working very closely with the system owners on.

A related point to the Member is, you could be referring to vulnerable components in third party applications, particularly where agencies or vendors may be unaware that the PHP is being used and have not taken steps or may not be aware to take steps to fix the vulnerabilities. For CIIs, the Cyber Security Code of Practice requires CII owners to maintain inventories of assets and dependencies, and to establish processes for identifying and managing those vulnerabilities.

In response to PHP2Shell vulnerability, CII owners were required to work with their vendors to identify potentially affected products as vendors continued to assess their PHP dependencies and take steps to resolve those vulnerabilities.

For Government systems, ourselves, we complement agency and vendor declarations with proactive scanning to identify potentially vulnerable PHP components, including those embedded within third party applications. So, it is not just a declaration exercise, we also take proactive steps, like scanning for those vulnerabilities. And potential exposures are then validated with the respective agencies and their vendors to determine whether the affected component is present and requires remediation.

So, we are taking a proactive approach.

12.00 pm

Mr Speaker: Ms Lee, I am sorry, we have run out of time and so, too, Ms Yeo. I thought we could come to your question, but it is end of Question Time.

Order. End of Question Time. Personal Explanation by Mr Fadli Fawzi.

[ Pursuant to Standing Order No 22(3), provided that Members had not asked for questions standing in their names to be postponed to a later Sitting day or withdrawn, written answers to questions not reached by the end of Question Time are reproduced in the Appendix. ]

Note(s) to Question No(s) 17:

1 Question subsequently withdrawn: To ask the Minister for Digital Development and Information in light of the critical PHP2Shell vulnerabilities disclosed on 21 October 2026 allowing unauthenticated remote code execution (a) whether the Government has inventoried and patched its systems running PHP; and (b) what steps are taken for Government systems on end-of-life PHP versions that no longer receive official security updates.

2 Question subsequently withdrawn: To ask the Minister for Digital Development and Information in light of PHP2Shell vulnerabilities (a) whether the Government has required or verified that third-party service providers maintaining systems on behalf of Government agencies have identified and patched all PHP components, including those embedded in third-party applications; and (b) what assurances are in place for systems built or maintained externally.