KISA Finds Critical PHP Security Flaws, Says "Install Security Updates"
"Attackers can take control of systems at will"
The Korea Internet & Security Agency (KISA) has recommended installing security updates after vulnerabilities were discovered in PHP, a programming language widely used to build websites.
According to KISA on Oct. 22, two vulnerabilities have been identified: “Improper Handling of Exceptional Conditions” (CVE-2026-109618), which involves failing to properly handle exceptional conditions, and “Use After Free” (CVE-2026-109619), which occurs when memory that has already been freed is referenced again.
The website of the University of Geneva in Switzerland appears to be inaccessible following the discovery of a PHP vulnerability. EPA Yonhap News
View original imageThe affected PHP products are versions 8.2, 8.3, 8.4 and 8.5. Specifically, versions earlier than 8.2.35, 8.3.36, 8.4.27 and 8.5.12, respectively, may be exposed to these vulnerabilities.
KISA recommended updating PHP to the relevant version or later. It emphasized that PHP 8.1 and earlier have already reached the end of official security support and should be upgraded to a supported version.
The vulnerabilities are reportedly flaws that could allow attackers to execute arbitrary code remotely or take control of systems without having to log in or go through an authentication process. Artificial intelligence (AI) reportedly played a key role in discovering the security flaws.
According to web technology analysis firm W3Techs, PHP is used by about 75% of websites for which the programming language can be identified. WordPress, a website-building tool used by about 43% of all websites, also runs on PHP.
Hot Picks Today
Despite "Insufficient Balance" Notices, They Board Anyway... Reports of Foreign Fare Evasion Mounting
- A "Rich Family's Daughter" Is "Effortlessly Polished" Today, "Glamorous" Tomorrow... Department Store-Core Has 20- and 30-Somethings Going Wild [Why&Next]
- "Even Underwear Has to Be Cut Up with Scissors"... China Hit by Rise of "Trash Hunters" in an "If You're Slow, You're Out" Scramble
- “Buy It Now or Miss Out”: Koreans Flock to Japan and Open Their Wallets Wide
- "Photos of Kim Jong Un Released by North Korea Are a Deception"... Debate Over Death Rumors Continues
Countries around the world are also taking steps to address the issue. Public institutions in some European countries, including the Netherlands and Finland, have suspended website operations as a precaution. The U.S. National Security Agency (NSA) also said, “We recommend that all organizations and businesses using PHP in their systems prepare to install updates to address the two critical vulnerabilities.”
© The Asia Business Daily. All rights reserved. Unauthorized AI training and use prohibited.
