Maldivian businesses and online services are facing an imminent threat following the discovery of critical security vulnerabilities in PHP, one of the world’s most widely used web programming languages. Government agencies and relevant authorities are urging stakeholders to pay urgent attention and take immediate protective measures.
Publicly disclosed on the 21st of this month, security researchers have dubbed the vulnerability "PHP 2 Shell." Under the Common Vulnerability Scoring System (CVSS)—the international benchmark for rating security severity—the flaw has been assigned a critical severity score of 9.2, placing it among the most dangerous cyber threats in existence.
Most alarmingly, this flaw enables threat actors to gain unauthorised access to underlying servers without requiring any valid usernames or passwords. Attackers can seize total administrative control of compromised servers and execute arbitrary malicious code remotely, effectively creating a backdoor that allows systems to be hijacked without alerting web administrators.
The Maldives Police Service confirmed that cybercriminals are already exploiting this vulnerability to target digital infrastructure both locally and internationally. With active exploitation attempts already detected against select systems, the issue poses a substantial challenge to the country's national digital ecosystem.
From small and medium-sized enterprises (SMEs) to prominent corporations and e-commerce platforms, countless local businesses rely heavily on web operations. A successful breach could lead to catastrophic leaks of customer personal data and financial transaction records, inflict severe repetitional damage, and trigger irreversible financial losses.
The risk is compounded by the fact that the vast majority of Maldivian websites operate on popular content management systems (CMS) like WordPress and other PHP-based frameworks. Sites running legacy, unpatched installations without routine security maintenance remain prime targets for exploitation.
The Maldives Police Service alongside the National Cyber Security Agency (NCSA) have jointly called on government entities, private commercial enterprises, and individual website administrators to take immediate containment and hardening steps. Authorities cautioned that negligence toward cyber hygiene could disrupt essential services at a national scale.
Mitigation hinges primarily on the immediate deployment of official PHP security patches. The Police Cyber Crime Centre directed administrators to upgrade their environments without delay to official stable versions—specifically PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, or any newer subsequent releases.
In addition, organisations have been advised to collaborate closely with their internal IT teams and hosting providers to audit server integrity and scrutinize access logs for anomalous behavior. Continuous active monitoring, defensive hardening, and heightened vigilance were highlighted as non-negotiable imperatives during this high-risk window.
Should system administrators suspect unauthorized intrusions or potential compromise, police urged them to isolate the affected systems from internal networks immediately to prevent lateral movement. Furthermore, entities must preserve all volatile digital evidence and forensic artifacts before reporting the incidents promptly to the Cyber Crime Centre.
As the Maldives accelerates its digital transformation, major cyber vulnerabilities of this magnitude test the resilience of both commerce and the broader economy. Rather than treating this purely as a technical IT matter, business leaders across every sector must recognize the stakes and act decisively to weather this brewing storm.