PHP 漏洞引發全球網絡安全警報

Screenshot of the Ministry of Science and ICT website. (Photo: Ministry of Science and ICT website screenshot)

An unprecedented security crisis has left 70% of websites worldwide exposed to hacking threats. Vulnerabilities discovered in PHP, a widely used web development language, could allow hackers to infiltrate servers without logging in. Countries are scrambling to prevent attacks, including taking affected websites offline. The South Korean government and relevant agencies have also launched emergency responses.

On Oct. 22, the Ministry of Science and ICT (MSIT) and the Korea Internet & Security Agency (KISA) raised the private-sector cyber crisis alert to "Caution," the second of four levels—Interest, Caution, Alert and Severe—following the disclosure of two PHP vulnerabilities by its developers the previous day. Authorities activated emergency response measures, including increasing personnel handling cyber incidents and keeping emergency response teams on standby.

"The newly disclosed vulnerabilities could allow attackers to take control of servers without authentication, and attack attempts have already been reported overseas. The speed of our response will determine the extent of the damage," Song Ki-ho, third deputy national security adviser, said at an emergency public-private-military cybersecurity meeting hosted by the National Security Office at the presidential office. "We must respond swiftly as one team."

PHP is a programming language used to develop websites and other web services. For example, when a customer enters a product name on an online shopping site, the server hosting the website searches for the product and returns the results. PHP is used to write the instructions that enable the server to perform such tasks. WordPress, a website creation and management platform, also runs on PHP. According to US web technology analysis firm W3Techs, approximately 70% of websites worldwide use PHP.

PHP's developers said Oct. 21 that an internal security audit had uncovered vulnerabilities and released emergency patches. Exploiting the flaws, dubbed "PHP2Shell," could allow hackers to remotely execute arbitrary code and compromise websites in as little as a few seconds without separate login or authentication procedures.

Governments worldwide have launched emergency responses. The US National Security Agency (NSA) issued an advisory urging organizations to apply the relevant security patches and recommending that systems be taken offline temporarily if immediate updates are not possible. According to Reuters, several European government agencies, including France's Interior Ministry and the Netherlands' National Cyber Security Centre, also temporarily suspended website operations.

Concerns are particularly acute in South Korea, where many websites reportedly run outdated PHP versions that cannot receive the updates. According to French cybersecurity company CybelAngel, approximately 25,000 servers in South Korea use PHP 8.1 or earlier, accounting for 82% of servers with identifiable versions. Because official updates are no longer available for versions 8.1 and earlier, operators must migrate to version 8.3 or later to apply the newly released security patches.

MSIT recommended blocking external access or temporarily suspending websites if updates cannot be applied. Deputy Prime Minister and Science and ICT Minister Bae Kyung-hoon said on Facebook that a swift response was necessary because the vulnerabilities could lead to customer data leaks or website defacement.

The PHP vulnerabilities have attracted further attention because they were discovered by an AI model. US cybersecurity company Calif identified the flaws while examining PHP source code using OpenAI's GPT-5.6 Sol and reported them to the developers. Wiz, a Google-affiliated cybersecurity company, subsequently discovered and reported the vulnerabilities through a separate investigation.

Security specialists had identified the problematic code years earlier but took no further action because exploiting it in actual attacks was considered technically difficult. The discovery that AI could find a way to exploit the code triggered the emergency response. Wiz co-founder Ami Luttwak told The Wall Street Journal that the flaws were "the most severe vulnerabilities ever discovered by AI" and were so complex that humans would never have found them without AI assistance.

The vulnerabilities must be fixed on the servers hosting websites, not on individual users' computers. Ordinary users do not need to install any additional software. Website operators or server management companies must apply the PHP security updates. PHP's developers said changing certain configuration settings alone would not fully resolve the problem.