PHP security flaws alarm Korean government, companies

The Ministry of Science and ICT urged Korean companies and institutions operating PHP-based websites to apply security updates immediately on Thursday. The PHP2Shell vulnerabilities could let attackers take control of servers or steal sensitive information without authentication, and experts warned that shared hosting could spread the impact across businesses. KISA said PHP versions 8.2 through 8.5 could be affected and recommended upgrading from unsupported versions 8.1 or earlier.

The vulnerabilities received a score of 9.2 out of 10 under the Common Vulnerability Scoring System, placing them in the critical severity category.

AhnLab estimated that Korea had 110,000 hosts running vulnerable PHP versions before patches were released, the sixth-highest number worldwide.

KISA issued its advisory around 11 p.m. Wednesday after the PHP development team released security updates.

A Korean communications technology firm called for patches on all publicly accessible PHP-based web services within 24 hours.

The ministry said the flaws affect PHP itself, so websites could be vulnerable even if their code was securely built.

Published Oct 22, 2026 3:37 pm KST

Updated Oct 22, 2026 4:50 pm KST

Deputy PM urges immediate security updates for firms

The website of the PHP Foundation is displayed on a mobile phone in Mierlo, the Netherlands, Wednesday. EPA-Yonhap

The Korean government has issued a nationwide security alert to businesses and website operators over critical vulnerabilities in PHP, a programming language widely used to build websites and web services, as the flaws spark widespread alarm across the globe amid concerns that they could rank among the most severe software vulnerabilities in history.

Experts warned that small and medium-sized enterprises (SMEs) and individual business owners operating websites without dedicated cybersecurity personnel could be particularly vulnerable. They strongly recommended prompt security updates, noting that a vulnerability in one company's website could also affect other businesses whose websites are hosted on the same server.

In a statement released Thursday, the Ministry of Science and ICT urged domestic companies and institutions operating PHP-based websites to immediately apply security updates.

“The latest PHP vulnerabilities could affect a vast number of websites in Korea. An extremely urgent response is required as exploit code is already publicly available," Deputy Prime Minister and Minister of Science and ICT Bae Kyung-hoon said.

“Conventional preventive measures, such as manual inspections followed by security patches several days later, cannot defend against attacks. Automated response systems are essential, including immediately blocking vulnerable internet-facing assets and proactively applying web application firewall rules.”

Popular website-building tools, such as WordPress and Gnuboard, are based on PHP. Many websites, including those of major government agencies, online stores and news outlets, are also built using the language.

The warning came after critical vulnerabilities, dubbed PHP2Shell, were found, driving government agencies and companies around the world to shut down websites.

The flaws were discovered by cybersecurity researchers, including Google-affiliated Wiz and Calif, which used OpenAI's GPT-5.6 Sol. They stem from how PHP handles memory, potentially allowing hackers to take control of servers or steal sensitive information without authentication.

The flaws received scores of 9.2 out of 10 under the Common Vulnerability Scoring System, placing them in the highest severity category, known as "critical." European cybersecurity authorities have also classified the vulnerabilities as "critical" and urged immediate security updates. They recommended temporarily disconnecting affected systems from the internet or suspending their operations if updates cannot be applied immediately.

LAN network cables plugged into a computer server, Wednesday. Reuters-Yonhap

As the issue becomes a global security threat, the Korea Internet & Security Agency (KISA), the country's cybersecurity authority, issued an advisory around 11 p.m. Wednesday, saying the PHP development team had released security updates to address the vulnerabilities.

KISA warned that four PHP versions — 8.2, 8.3, 8.4 and 8.5 — could be affected and urged users to install the latest security updates for their respective versions. It also strongly recommended upgrading from PHP 8.1 or earlier versions, which are no longer supported with security updates.

According to cybersecurity firm AhnLab, Korea had an estimated 110,000 hosts (servers) running vulnerable versions of PHP before the security patches were released, the sixth-highest number in the world.

Unlike other vulnerabilities, the latest flaws affect PHP itself, meaning even websites built with secure code could be vulnerable, the ICT ministry said.

Major IT companies in Korea are also issuing internal emergency alerts and intensifying their security measures. In an internal notice Thursday, one of Korea’s largest communications technology firms warned that the PHP flaws could allow external attackers to execute arbitrary commands and called for security patches to be applied to all publicly accessible PHP-based web services within 24 hours.

Experts said the vulnerabilities could expose websites to attacks even if they were built with strong security measures in place. Smaller businesses may face greater difficulties in responding because they often lack dedicated cybersecurity personnel and resources, leaving websites running on outdated PHP versions.

“As the patches are already available, what’s important now is having companies quickly identify which services are running vulnerable versions of PHP and apply the patches,” ENKI WhiteHat CEO Lee Sung-kwon told The Korea Times. “Smaller companies and online shopping malls run by individuals often don't have dedicated security personnel to handle such tasks."

The PHP flaws are drawing the industry’s attention, particularly because the risks may extend beyond individual websites if multiple businesses share the same compromised hosting server.

"If a company operates a PHP server that hosts multiple businesses, all of them could be affected," Lee said. "If information from multiple customers is stored on the same server, the impact could spread to those customers as well."

The science ministry said SMEs and others operating websites through hosting providers should check with their providers to confirm whether security updates have been applied. Domestic hosting companies said they are applying security patches, but cautioned that it is difficult to determine whether all websites are protected because customers use different PHP versions and security configurations.

韩国科学技术信息通信部（KISA）周四敦促运营基于PHP网站的韩国企业和机构立即进行安全更新。PHP2Shell漏洞可能允许攻击者在未经身份验证的情况下控制服务器或窃取敏感信息，专家警告称，共享主机可能会使该漏洞的影响扩散到整个企业。KISA表示，PHP 8.2至8.5版本可能受到影响，并建议从不受支持的8.1或更早版本升级。

根据通用漏洞评分系统，这些漏洞的得分为 9.2 分（满分 10 分），属于严重级别。

AhnLab 估计，在补丁发布之前，韩国有 11 万台主机运行着存在漏洞的 PHP 版本，这一数字在全球排名第六。

在 PHP 开发团队发布安全更新后，KISA 于周三晚上 11 点左右发布了安全公告。

一家韩国通信技术公司要求在24小时内修复所有可公开访问的基于PHP的Web服务。

该部门表示，这些缺陷会影响 PHP 本身，因此即使网站代码构建得很安全，也可能存在安全漏洞。

发布于2026年10月22日下午3:37（韩国标准时间）

更新于2026年10月22日下午4:50（韩国标准时间）

副总理敦促各公司立即更新安全措施。

周三，在荷兰米尔洛，一部手机上显示着PHP基金会的网站。（图片来源：EPA-Yonhap）

韩国政府已向全国企业和网站运营商发出安全警报，提醒他们注意 PHP（一种广泛用于构建网站和网络服务的编程语言）的严重漏洞。这些漏洞引发了全球范围内的广泛恐慌，人们担心它们可能成为历史上最严重的软件漏洞之一。

专家警告称，没有专门网络安全人员运营网站的中小型企业和个体经营者可能尤其容易受到攻击。他们强烈建议及时进行安全更新，并指出一家公司网站上的漏洞也可能影响托管在同一服务器上的其他企业网站。

韩国科学技术信息通信部周四发表声明，敦促国内运营基于 PHP 的网站的公司和机构立即应用安全更新。

“最新的PHP漏洞可能会影响韩国大量的网站。由于漏洞利用代码已经公开，因此需要采取极其紧急的应对措施。”韩国副总理兼科学技术信息通信部部长裴京勋表示。

“传统的预防措施，例如人工检查，几天后再发布安全补丁，无法抵御攻击。自动化响应系统至关重要，包括立即阻止易受攻击的面向互联网的资产，并主动应用Web应用程序防火墙规则。”

流行的网站搭建工具，例如 WordPress 和 Gnuboard，都是基于 PHP 的。许多网站，包括主要政府机构、在线商店和新闻媒体的网站，也是用这种语言构建的。

此前，名为 PHP2Shell 的严重漏洞被发现，导致世界各地的政府机构和公司关闭网站，随后发布了这一警告。

这些漏洞是由包括谷歌旗下的 Wiz 和 Calif 在内的网络安全研究人员发现的，他们使用了 OpenAI 的 GPT-5.6 Sol 模型。这些漏洞源于 PHP 的内存管理方式，可能允许黑客在未经身份验证的情况下控制服务器或窃取敏感信息。

这些漏洞在通用漏洞评分系统（CVSS）中获得 9.2 分（满分 10 分），属于最高严重级别，即“严重”。欧洲网络安全机构也已将这些漏洞列为“严重”级别，并敦促立即进行安全更新。他们建议，如果无法立即进行更新，则应暂时断开受影响系统的互联网连接或暂停其运行。

周三，局域网线缆插入一台计算机服务器。（路透社-韩联社）

随着该问题演变为全球安全威胁，韩国互联网安全局（KISA，韩国网络安全机构）于周三晚上 11 点左右发布公告称，PHP 开发团队已发布安全更新以解决这些漏洞。

KISA警告称，PHP 8.2、8.3、8.4和8.5四个版本可能受到影响，并敦促用户为其各自版本安装最新的安全更新。KISA还强烈建议从PHP 8.1或更早版本升级，因为这些版本已不再获得安全更新支持。

据网络安全公司 AhnLab 称，在安全补丁发布之前，韩国估计有 11 万台主机（服务器）运行着存在漏洞的 PHP 版本，这一数字位居世界第六。

信息通信技术部表示，与其他漏洞不同，最新的漏洞会影响 PHP 本身，这意味着即使是使用安全代码构建的网站也可能存在漏洞。

韩国各大IT公司也纷纷发布内部紧急警报，并加强安全措施。韩国一家大型通信技术公司周四发布内部通知，警告称PHP漏洞可能允许外部攻击者执行任意命令，并要求在24小时内为所有公开访问的基于PHP的Web服务应用安全补丁。

专家表示，即使网站构建时采取了强大的安全措施，这些漏洞仍可能使其遭受攻击。小型企业应对这些漏洞可能面临更大的困难，因为它们通常缺乏专门的网络安全人员和资源，导致网站运行的 PHP 版本过时。

ENKI WhiteHat首席执行官李成权告诉《韩国时报》：“由于补丁已经发布，现在重要的是企业尽快识别哪些服务运行着存在漏洞的PHP版本，并应用这些补丁。小型公司和个人运营的在线商城通常没有专门的安全人员来处理这类任务。”

PHP 的缺陷引起了业界的关注，尤其是如果多个企业共享同一个受感染的托管服务器，风险可能不仅限于单个网站。

李说：“如果一家公司运营着一个为多家企业提供服务的PHP服务器，那么所有这些企业都可能受到影响。如果多个客户的信息存储在同一个服务器上，那么这些客户也可能受到影响。”

科学部表示，通过主机服务商运营网站的中小企业和其他用户应向其服务商确认是否已安装安全更新。国内主机服务商表示正在安装安全补丁，但也提醒说，由于客户使用的PHP版本和安全配置各不相同，因此很难确定所有网站是否都受到保护。