Firms here should ‘act now’ to fix critical PHP vulnerabilities: Singapore’s cybersecurity chief