Komdigi Cyber Alert: Steps to Fix Outdated Government PHP

Indonesia’s Ministry of Communication and Digital Affairs (Komdigi) sent three cyber alert letters to government bodies on November 9, 2026, asking ministries, agencies, local governments and public service operators to tighten system security. The alert arrives as a scan by security firm Vaksincom found that 96.7% of readable PHP hosts on .go.id domains still run outdated versions of PHP.

Three letters from Komdigi

The letters came from Komdigi’s Directorate General of Digital Government Technology and followed a Security Advisory issued by the National Cyber and Crypto Agency (BSSN) on November 8. According to CNN Indonesia, they went to three groups:

• users of National Data Center 1 (PDN-1) and the Government Cloud;
• officials who manage domain names at ministries, agencies and local governments;
• all public-scope electronic system operators, known in Indonesia as PSE.

The letters ask recipients to harden their systems, step up network monitoring, check for vulnerabilities and be ready to coordinate if an incident occurs. Operators were also told to make sure incident response teams are on standby, strengthen authentication for administrator accounts, update software, improve protection against DDoS attacks and confirm that data backups and service recovery procedures work.

The Komdigi press statement lists the threats it has in mind: DDoS attacks (flooding a server with traffic until the service fails), website defacement, exploitation of security flaws, DNS hijacking, and phishing combined with false information.

An unverified threat

The alert is precautionary. The threat circulated on social media and was linked to opposition to the Sistem Pemungutan Pajak atas Transaksi Digital Luar Negeri (SPP-TDLN), a system that collects VAT on foreign digital services through the banks and fintech firms that process the payments. BSSN, through Gov-CSIRT Indonesia, said neither the authenticity of the threat nor the capability of those behind it has been verified.

Aries Kusdaryono, Komdigi’s Director of Digital Government Technology Strategy and Policy, still asked agencies to prepare. “Kita tidak boleh mengabaikan potensi risiko ancaman serangan tersebut,” he said, as quoted by CNN Indonesia, meaning the potential risk should not be ignored. Deputy Minister Nezar Patria told Katadata that Komdigi was awaiting further direction from BSSN. He also described attacks that use AI agents as a new model that needs its own risk management, such as testing in isolated sandbox environments.

The attack counts quoted in the media deserve some care. CNN Indonesia cited Fortinet’s threat map, which logged about 1.6 million blocked attacks in the 24 hours to 08:41 WIB on November 9, around 121,000 of them aimed at the government sector. Katadata, using data as of 07:30 WIB on November 10, reported about 2.2 million attempts. These figures describe activity detected by security devices, so they are best read as a sign that automated scanning is busy. The same wave earlier prompted Indonesia’s financial regulator to put banks on alert, as covered in our piece on cyber attacks against Indonesian banks.

What Vaksincom found on government servers

The instruction to “update software” becomes concrete next to Vaksincom’s research. The firm scanned internet-facing PHP servers in Indonesia as of October 23, 2026, two days after the PHP project released fixes for two critical flaws nicknamed PHP2Shell. Our article on PHP2Shell and the patched PHP versions explains those flaws in detail.

CNN Indonesia reported that Vaksincom detected 89,193 active hosts with 99,896 PHP version matches. Of those matches, 69.6% were end-of-life (EOL) versions that no longer receive security fixes from the PHP project. Only 226 matches, about 0.2%, ran a version with the latest fixes.

Government domains were in the worst shape. Of 1,677 .go.id hosts whose PHP version could be read, 1,621, or 96.7%, ran an EOL release. Corporate .co.id domains showed the same share, while universities (.ac.id) stood at 88.7% and schools (.sch.id) at 69.9%.

The most common version on .go.id and .co.id hosts was PHP 5.6.40. According to php.net’s list of unsupported branches, the 5.6 branch reached end of life on December 31, 2018. Other frequent versions were PHP 7.4.33, from a branch that ended on November 28, 2022, and PHP 8.2.12. The 8.2 branch still receives security fixes until December 31, 2026, but 8.2.12 needs to move to 8.2.35.

Vaksincom security expert Alfons Tanujaya, quoted by Liputan6, said the core problem is dependence on legacy systems. Applications written for PHP 5 often need code changes before they can run on PHP 8. The large number of PHP 8.2.12 hosts also suggests public servers set up with all-in-one packages such as XAMPP, which are meant for testing on a developer’s computer.

Limits of the scan

Vaksincom notes that its data comes from scanning servers exposed to the internet. A server running EOL PHP has not necessarily been breached. Some Linux distributions also backport security fixes without changing the version number, so the real number of protected servers may be higher than the scan shows. Internal servers that the scan could not reach still need to be checked by their owners.

What this means for government agencies

For agencies and local offices, the Komdigi alert and the Vaksincom findings point to the same work: know what is running on your own servers, then close the gaps that are easiest to exploit. These steps can start this week.

1. List every site and application. Record all agency subdomains, including old event portals or registration apps that few people open. Forgotten sites are usually the ones that go longest without updates.
2. Check the PHP version that actually serves the web. The command-line version can differ from the one used by PHP-FPM or the Apache module. Compare the result with the support table on php.net.
3. Update branches that are still supported. Servers on PHP 8.2 to 8.5 can move straight to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Keep in mind that PHP 8.2 support ends at the end of December 2026.
4. Shield systems that cannot migrate yet. For PHP 5 or 7 applications still in use, Vaksincom recommends limiting public access through a web application firewall (WAF) or VPN, applying patches from the Linux distribution, and setting expose_php = Off in php.ini so the version is harder to scan.
5. Prepare the reporting path. Agencies on PDN-1 or the Government Cloud can report incidents to PDN-CSIRT at csirtpdn.layanan.go.id or [email protected]. Make sure every system administrator also knows how to reach the internal incident response team.

Moving a legacy application to PHP 8 is a project in its own right, since code, libraries and tests all need adjusting. Agencies can begin with the services citizens use most, such as permits or public complaints, and schedule the rest in the next budget cycle. Guidance on organizing public service applications is available on our digital government solutions page.

Domain managers should also review access to their DNS control panels. DNS hijacking is among the threats Komdigi named, and the basic defenses are strong passwords, two-factor authentication and a short list of people allowed to change domain records.

Frequently asked questions

Have government websites been hacked in this wave?

The sources we reviewed do not report any government website breach tied to this threat. BSSN says the threat has not been verified, and Vaksincom stresses that a server on outdated PHP has not necessarily been compromised. The Komdigi alert is meant to prevent incidents rather than respond to one.

How can an agency tell which PHP version its site uses?

The most reliable way is to check on the server itself, for example with the PHP-FPM version command or a phpinfo() page that an administrator opens briefly and then removes. Sites on shared hosting or run by a vendor can ask the provider directly, including the update schedule and any other PHP versions still active on the account.

What should citizens watch out for?

Komdigi asked the public to be careful with emails, messages and links that claim to come from government agencies, especially those mentioning digital tax issues. Do not share passwords or personal data through channels whose authenticity is unclear, and use government services only through their official website addresses.

Closing

The Komdigi alert gives agencies a clear reason to review servers, admin accounts and backups in the coming days. Vaksincom’s findings show the most obvious place to start: old PHP applications that still serve citizens every day. If your agency needs support with an audit or an application migration, Merakit’s cybersecurity team is ready to talk.

Sources

• Jutaan Serangan Siber Ancam RI, Komdigi Imbau Perkuat Keamanan Digital, CNN Indonesia, November 10, 2026
• Komdigi Minta Instansi Pemerintah Waspada Ancaman Serangan Hacker, Katadata, November 10, 2026
• Komdigi Terbitkan Tiga Surat Imbauan Antisipasi Serangan Hacker ke Pemerintah, Katadata, November 10, 2026
• Siaran Pers Kemkomdigi Waspadai Ancaman Serangan Siber, Headline.co.id, November 10, 2026
• Riset: PHP Lawas Ancam Keamanan Situs Pemerintah dan Korporasi RI, CNN Indonesia, October 26, 2026
• 69 Persen Server di Indonesia Terancam Diretas Akibat Celah PHP, Liputan6, October 26, 2026
• Unsupported Branches and Supported Versions, php.net, accessed November 10, 2026