On 21 October 2026, the Cyber Security Agency of Singapore (CSA) issued alert AL-2026-151 about two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). PHP is the programming language behind a large share of the world’s websites and online systems. The flaws could let an attacker run code on an unpatched server without logging in. CSA has asked every organisation running PHP to update right away.
Some Aptsys cloud services use PHP. We’d rather you hear about this PHP security alert from us than from the news, so here is where we stand and what it means for your restaurant.
What this PHP security alert means for Aptsys merchants
- Jade POS in-outlet operations are not expected to be affected. Your counter can keep taking orders and payments as usual.
- We acted the same day the alert was published and put protective measures in place.
- We are now upgrading our cloud servers to the latest patched PHP version. That is the permanent fix CSA recommends.
We are treating this as urgent. Attackers watch alerts like this one and move quickly to target systems that haven’t been updated.
How we are rolling out the upgrade
We are upgrading in stages, not all at once. After each upgrade we test that QR ordering, GEMSCMS, CRM and loyalty, and third-party integrations still work before we move on.
All upgrade work is done at night, outside trading hours, so your outlets are disrupted as little as possible.
What you may notice during the upgrades
The new PHP version works differently from the old one in some places, so some services may be briefly affected during or just after an upgrade. For example:
- QR ordering may be slower or briefly unavailable
- Sales or member data may take longer to sync to GEMSCMS
- An integration, such as delivery or accounting, may need a restart
If anything looks wrong at your outlet, contact us immediately. We are prioritising every report linked to the upgrade.
What we recommend you do now
1. Hold off on big changes for the next two weeks. Avoid scheduling menu overhauls, new promotions or major CRM campaigns during the upgrade period. With year-end promotions coming up, it’s better to launch them once the upgrades are finished.
2. Check your business continuity plan. Every outlet should know how to keep trading if a cloud service is briefly unavailable. That means knowing who to call, how to take orders manually, and how to record sales so they can be entered later.
3. Check your own systems too. This PHP security alert covers every PHP version, not just Aptsys. If your restaurant website, online shop or booking page runs on WordPress or another PHP platform, ask your web developer or hosting provider to confirm it has been patched.
Our commitment
We know any disruption costs you money, especially heading into Singapore’s busiest dining season. Our goal is to close this risk quickly without breaking the systems you rely on every service. We will post another update here once the upgrades are complete.
Questions or an urgent issue? Contact our support team at support@aptsys.com.sg or WhatsApp +65 8126 8448. Merchant information and updates: aptsys.com.sg/merchant-information.
Ernest Lim, Founder, Aptsys Technology Solutions Pte Ltd
