The Maldives Digital Service (MDS), working with the National Cyber Security Agency (NCSA), has begun emergency security patching and system hardening across government digital infrastructure after critical vulnerabilities were identified in PHP web technologies.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, were detected using artificial intelligence tools. Cybersecurity firm Wiz described them as among the most severe security issues uncovered by AI to date, posing risks of unauthorised access to affected systems.
The PHP development team released urgent updates for versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Authorities have strongly advised all affected systems to apply the patches immediately. Institutions unable to update promptly have been urged to take their websites offline temporarily.
MDS technical teams are conducting continuous assessments, applying patches and implementing additional protective measures. Temporary service disruptions may occur on public digital platforms during the rollout, though MDS has said efforts are under way to minimise downtime and restore full operations as quickly as possible.
In statements, MDS emphasised that the measures aim to prevent unauthorised access and strengthen the resilience of government digital services. The agency continues to monitor the situation in coordination with NCSA.
The response highlights ongoing efforts to protect national digital infrastructure amid evolving cyber threats.