Indonesia's Ministry of Industry disables digital services due to PHP2Shell vulnerability

The Indonesian Ministry of Industry (Kemenperin) has temporarily deactivated its official website and various digital services, including the National Industrial Information System (SIINas) and the Domestic Component Level (TKDN) portal. The shutdown, scheduled from October 22 to October 25, 2026, serves as a risk mitigation measure against the PHP2Shell cyber vulnerability.

The PHP2Shell flaw (CVE-2026-109618 and CVE-2026-109619) is rated with a critical severity score of 9.2 out of 10. This vulnerability allows hackers to execute malicious code on affected servers and potentially expose sensitive data. The National Cyber and Crypto Agency (BSSN) has recommended updating PHP to secure versions to prevent exploitation.

Globally, the PHP2Shell vulnerability has prompted significant action from major technology firms. OpenAI reported collaborating with PHP maintainers and security researchers to address the issue, noting that the bug had existed in PHP for 14 years. Google's security unit, Wiz, and its Gemini AI have also been utilized to investigate and verify fixes for the vulnerability.