The Maldives Digital Service, working with the National Cyber Security Agency, has started emergency security patching and system hardening across government digital infrastructure.
The action follows the discovery of critical vulnerabilities in PHP web technologies, specifically CVE-2026-109618 and CVE-2026-109619. These flaws pose risks of unauthorised access. The issues were initially detected using artificial intelligence, with cybersecurity firm Wiz describing them as among the most severe security problems uncovered by AI to date.
The PHP development team has released urgent security updates for versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Authorities advise all affected systems to update immediately. Institutions unable to apply patches promptly are urged to take websites offline temporarily.
Technical teams are conducting continuous assessments, applying patches and enforcing additional protective measures. Temporary service disruptions may occur on public digital platforms during the rollout, though MDS aims to minimise downtime and restore services quickly.
MDS stated that the measures address potential security risks, prevent unauthorised access and strengthen the protection and resilience of government digital infrastructure and services. The agency remains committed to national cybersecurity readiness.
The updates follow standard security advisory processes. Users of government online services are advised to monitor for any temporary interruptions and retry access as services are restored.
