What Changed
- The Digital Policy Office issued a Security Alert directing all Hong Kong Government B/Ds and public organisations to conduct an immediate review and complete PHP patching or isolate affected systems.
- DPO confirmed completion of PHP patching for the web content hosting service hosting all Hong Kong government homepages, reporting no security incidents.
- HKCERT published a Security Bulletin and media message offering technical support via email, phone, and online form to help organisations and the public apply patches.
Hong Kong’s Digital Policy Office (DPO) has issued a security alert following the identification of critical security vulnerabilities in PHP, a backend web programming language widely utilized across global web platforms. The directive affects all Hong Kong Government Bureaux and Departments (B/Ds), public organisations, as well as private sector enterprises and public users maintaining web systems reliant on PHP.
On October 22, 2026, the DPO formally issued a Security Alert instructing all B/Ds and public organisations in Hong Kong SAR to perform an immediate and comprehensive review of their information systems to check whether they have been affected by critical PHP vulnerabilities. Entities are required to complete all necessary software patching as soon as possible. In cases where patching cannot be completed immediately, organisations must temporarily take the relevant systems offline or isolate them to reduce the risk of unauthorized or malicious intrusion.
Additionally, the DPO announced that required patching has already been completed for the web content hosting service supporting the homepages of all government B/Ds. As of the time of the announcement, the DPO has received no reports of related cybersecurity incidents.
In conjunction with the government alert, the DPO appealed to all sectors, including private businesses and the public, to apply relevant PHP patches without delay. To assist affected entities, the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) issued a Security Bulletin and a public media message on October 22, 2026. HKCERT is offering technical guidance via email ([email protected]), telephone (8105 6060), or online form.
Because PHP is widely used in server-side web operations internationally, vulnerabilities in the language present potential security risks for cross-border organisations operating in or connected to Hong Kong SAR. Timely system updates are critical to maintaining network security and preventing potential cyber threats.
Who May Be Affected
Hong Kong Government Bureaux and Departments, public organisations, private sector businesses, and members of the public operating PHP-based web systems.
Cross-Border Context
Because PHP is widely used in global web development, vulnerabilities in the software affect multinational businesses and organizations operating web services in or linked to Hong Kong SAR.
What to check next
- Review technical details and patching guidance in the HKCERT Security Bulletin published on October 22, 2026.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.