Science ministry raises cyber alert as critical PHP flaw hits Korean websites

The science ministry said it had raised South Korea's private-sector cyber threat alert from "interest" to "caution" at noon after two critical vulnerabilities were disclosed in PHP, the programming language used to build a large share of the world's websites.

The Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) urged Korean companies and institutions running PHP-based sites to apply the security updates without delay, warning that attackers could execute commands on affected servers without a login. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and carry a severity score of 9.2 under the CVSS rating system.

PHP underpins homepages, online shopping malls, bulletin boards and administrator pages, and widely used Korean website-building tools such as WordPress and Gnuboard run on it. Because the weakness lies in PHP itself rather than in any individual site's software, even carefully built homepages can be exposed.

Successful attacks could let hackers quietly install remote-control files known as webshells, leak customer information or deface and knock out websites, the ministry said. Cyber security agencies in the European Union, Britain, the Netherlands and Germany have rated the flaws as critical and advised organisations to update immediately or, where that is not possible, disconnect or suspend affected systems.

The PHP development team released a fix on Oct. 21, and KISA posted an advisory the same day on its Boho website. Sites must run PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and above, and web services must be restarted after updating. Versions 8.1 and earlier no longer receive official updates, while the ministry recommended moving to 8.3 or later.

Officials also asked operators to check for signs of intrusion, including unusual access logs and webshell installations, because details of the flaws circulated before the patch was issued and overseas security firms have reported attack attempts. Suspected cases should be reported to KISA. Small businesses that run sites through hosting providers should ask the provider whether the update has been applied.

The ministry said it had sent the advisory to companies that have appointed a chief information security officer, major information and communications infrastructure operators, companies certified under the information security management system, web hosting firms, internet data centers and members of its cyber threat information sharing network, and is monitoring attack activity with security firms at home and abroad.

"This PHP vulnerability can affect a great number of homepages in Korea, and with attack code already public, a very urgent response is needed," Deputy Prime Minister and Science Minister Bae Kyung-hoon said. He said the usual patch cycle of several days after manual checks cannot stop such attacks, and that automated systems allowing immediate blocking of internet-facing assets and pre-emptive application of web firewall rules are essential.

Bae added that the situation requires all government ministries to respond as one team, and that the government will work with them to discuss security inspections and remedial measures for small and medium-sized enterprises.