Maldives Police urge urgent security updates amid PHP cyberattack threat

Maldives Police Service has issued a cybersecurity warning over a critical vulnerability affecting PHP, a programming language widely used in websites and online applications, urging government institutions, businesses and website operators to take immediate precautions against potential cyberattacks.

In a cybersecurity advisory issued on Thursday evening, police said security vulnerabilities in PHP had been disclosed following their discovery using artificial intelligence (AI).

The vulnerability, identified as "PHP2Shell", has been assigned a critical severity score of 9.2 under the Common Vulnerability Scoring System (CVSS v4.0).

According to police, the vulnerability could allow attackers to execute unauthorised code on servers and gain control of websites without requiring usernames or passwords.

Police warned that hackers were actively attempting to exploit the vulnerability, potentially exposing confidential information and disrupting online services.

The Maldives Police Service and the National Cyber Security Agency (NCSA) urged government agencies, businesses and website administrators to implement security measures without delay, particularly those operating PHP-based systems and platforms such as WordPress.

The advisory recommended upgrading PHP installations to the latest applicable security releases, identifying versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or later officially released versions.

Website operators were also advised to contact their IT administrators or hosting providers to verify that their servers had been secured against the vulnerability.

Police further recommended strengthening security monitoring, implementing additional protective measures and regularly reviewing systems for signs of unauthorised activity.

Organisations that suspect unauthorised access were urged to preserve digital evidence and report incidents to police without delay.

The advisory also instructed website administrators to isolate affected systems from their networks immediately if a cyberattack or unauthorised intrusion is suspected or detected.

Such incidents should be reported to the Maldives Police Service Cyber Crime Centre, police said.

Authorities urged all organisations using PHP-based systems to take the recommended precautions to reduce the risk of cyberattacks, data breaches and interruptions to online services.