Critical Security Flaw in Programming Language 'PHP' Triggers Global Hacking Alert... South Korea Scrambles to Respond (Full Story)

Ministry of Science and ICT: "Security Guidelines Distributed"
South Korean Companies Scramble to Prepare Countermeasures
Experts Urge Swift Updates

A critical security vulnerability has been discovered in PHP, a programming language used by more than 70% of websites worldwide, triggering a global hacking alert. The impact is spreading: the U.S. government has urged organizations to install security updates immediately, while websites operated by government agencies and major public services in Europe have been shut down one after another. On October 22, the Ministry of Science and ICT began sharing information about the PHP vulnerability and security guidelines with companies and major institutions, and started preparing response measures.

A senior official at the Ministry of Science and ICT said, "We first disseminated information about the newly identified PHP vulnerability and security guidelines through the chief information security officers (CISOs) of companies." The official added, "We plan to monitor whether companies' websites use PHP and whether they have installed security updates in response to the vulnerability." The Korea Internet & Security Agency (KISA) also issued an urgent notice warning of the risks posed by the vulnerability in PHP and recommending that users install security updates.

A hard disk drive installed in a computer server in Berlin, Germany, on the 21st (local time). IT security agencies have warned that websites could become inaccessible while PHP prepares a security patch. Berlin, Germany = Reuters-Yonhap News.

Update Immediately... If That Is Not Possible, Take Systems Offline

According to The Wall Street Journal (WSJ) on October 21, the U.S. National Security Agency (NSA) said that day via X (formerly Twitter), "We recommend that all organizations and companies using PHP in their systems prepare to install a security update." It urged them to take the affected systems offline until the vulnerability is fully resolved if an immediate update is not possible. The Federal Bureau of Investigation (FBI) also warned that hackers were increasingly likely to exploit the PHP security flaw to gain unauthorized access to servers.

In Europe, websites were taken offline one after another as a precaution. In the Netherlands, services were suspended on government portals, the Port of Rotterdam's website, the football association's website, and websites for major political parties and hospitals. The Finnish government also temporarily suspended public network services, while Belgium's Ministry of Foreign Affairs and local government websites, as well as a communications platform for public schools in Denmark, blocked access. Some government websites in Germany, France, and the Czech Republic were also taken offline as a precaution.

Industry players have also stressed the severity of the vulnerability. In a statement issued that day, OpenAI said, "Given the severity of this flaw and the widespread use of PHP, we consider it one of the most consequential security vulnerabilities in recent years."

French government website blocks access while PHP prepares a security patch. Reuters-Yonhap.

PHP is a free, open-source programming language widely used to run websites. When a user visits a webpage, PHP assembles content on the server and displays it on the screen. Two vulnerabilities were discovered in this case, which the cybersecurity industry has dubbed "PHP2Shell." The flaws occur during the server's memory-handling process and could allow hackers to access a server and execute arbitrary commands without logging in or undergoing authentication. Reuters reported that a successful attack could lead to the theft of personal information or a server being taken over. Both flaws also received a score of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS), the international standard for assessing security vulnerabilities, putting them in the highest "critical" severity category.

The WSJ reported that the vulnerabilities were discovered during artificial intelligence (AI) research. Cybersecurity company Calif used OpenAI's "GPT-5.6 Sol" to report the first vulnerability on August 11. Google-affiliated cybersecurity company Wiz also used AI to report the second vulnerability on August 24. The flaws are believed to have existed for some time but remained undiscovered because their exploitability was difficult to demonstrate.

PHP's developers moved up the release of the security patch by one day, from the originally scheduled date of October 22. However, concerns about the spread of damage are growing after information about the vulnerabilities was leaked in advance and some hacking attempts were detected. Tai Duong, CEO of Calif, told the WSJ, "Someone could use AI to analyze the security patch and publish code for a hacking attack." He warned, "If that happens, the resulting chaos could spiral out of control."

Domestic Response Efforts Underway... Urgent Need for Internal AI Controls

With a critical security vulnerability discovered in PHP, companies in South Korea are working urgently to prepare responses. The government has recommended updating to PHP versions in which the vulnerability has been fixed, while experts have also stressed the need for swift updates given the high risk that the newly discovered vulnerability could be exploited.

According to KISA, four PHP versions are affected: 8.2, 8.3, 8.4, and 8.5. Specifically, users of versions earlier than 8.2.35, 8.3.36, 8.4.27, and 8.5.12, respectively, may be exposed to the vulnerability. KISA recommended updating PHP to those versions or later. It particularly emphasized that official security support for PHP 8.1 and earlier has already ended, and that users should upgrade to a supported version.

The incident has a broad impact because PHP is widely used worldwide to build websites. According to W3Techs, a web technology analytics company, about 70% of websites for which the programming language can be identified use PHP. WordPress, a website creation and management system used by about 43% of all websites, also runs on PHP.

A person works on a laptop at a cafe in London, UK, on the 21st (local time). London, UK = Reuters-Yonhap News.

Experts stressed that updates to address the vulnerability should be installed as quickly as possible. Choi Byeongho, a professor at Korea University's Human-Inspired AI Institute, said, "Security patches, such as updates to a PHP version in which the security issue has been fixed, should be installed as quickly as possible." He warned, "It is only a matter of time before AI agents are misused to launch attacks targeting the PHP vulnerability." Choi added, "If it is difficult to update immediately, organizations need to take measures such as disconnecting from the network while they look for a response."

Security Must Be Built In From the Program Development Stage

Experts also advised that a paradigm shift is needed to make security a top priority during development. Hwang Seokjin, a professor at Dongguk University's Graduate School of International Affairs and Information Security, said, "As AI-powered vulnerability attacks accelerate the speed of attacks, reactive responses will reach their limits." He emphasized, "Security must be built in from the program development stage, and even when AI is used in development, there must be a system in place for people to verify the results."

Park Chanam, CEO of Stealien, said, "As AI makes it possible to actually discover and exploit vulnerabilities like the one in the PHP incident, the paradigm of cybersecurity will change completely." He emphasized, "Rapid security updates are most important, and each institution must also pay attention to security and internal controls in step with advances in AI." However, the incident is not expected to have a major impact on the websites of major domestic platform companies, which make limited use of PHP. An industry official at a major domestic platform company said, "We do not use PHP as our primary technology," adding, "We are closely monitoring the situation by keeping an eye on newly released patches and global developments."

This content was produced with the assistance of AI translation services.