MDS warns of possible service disruptions as security patches roll out

Maldives Digital Service (MDS) has warned of possible temporary disruptions to government digital services as it implements security measures to address critical vulnerabilities affecting PHP web technologies.

In a security advisory, MDS said it was working with the National Cyber Security Agency (NCSA) to apply necessary patches, mitigate vulnerabilities and strengthen system security.

The vulnerabilities were identified as CVE-2026-109618 and CVE-2026-109619.

The agency said the measures were intended to address potential security risks, prevent unauthorised access and strengthen the protection and resilience of government digital infrastructure and services.

Temporary service disruptions may occur while these security measures are being implemented

the advisory stated.

MDS said it would work to minimise the impact and restore affected government digital services as quickly as possible.

MDS said it remained committed to strengthening national cybersecurity readiness in coordination with NCSA and ensuring the continued security, reliability and resilience of government digital services.

The advisory comes amid international warnings over two critical PHP security flaws, identified as CVE-2026-109618 and CVE-2026-109619 and collectively known as “php2shell”.

The vulnerabilities involve errors in how PHP manages memory when processing web requests and could allow attackers to run unauthorised code on affected servers without logging in.

Canada’s cybersecurity authority has urged organisations to update affected systems, warning that internet-facing websites and applications face heightened risk.

In the Maldives, MDS has explicitly linked its ongoing security measures to these same vulnerabilities, bringing the international alert into focus for government digital services.

However, the agency has not identified specific affected platforms or reported a confirmed breach, describing the work as a precaution to prevent unauthorised access and protect services.