Critical security flaws have been found in PHP, the programming language often called the backbone of the web, triggering alarm worldwide. Because PHP is used widely across web services run by companies, online shopping malls, public agencies and financial and medical institutions, concerns are mounting that the flaws could lead to large-scale cyberattacks. In South Korea, the risk is seen as particularly high because a large share of services still run outdated PHP versions that no longer receive security support.
According to the security industry on the 22nd, PHP developers released an emergency security update on the 21st to fix two vulnerabilities, dubbed "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619), that allow an outside attacker to execute arbitrary code on a server without any authentication. Both flaws scored 9.2 out of 10 under version 4.0 of the Common Vulnerability Scoring System (CVSS), placing them in the highest risk category, "Critical."
PHP is a programming language widely used in web development. About 70% of websites worldwide whose server-side programming language can be identified use PHP, according to web technology analysis firm W3Techs. WordPress, the globally popular website-building tool, as well as South Korea's Gnuboard and Rhymix, are all built on PHP.
The two newly disclosed flaws involve memory corruption, which occurs when memory runs short, and use-after-free, in which already released memory is referenced again. An attacker can exploit them by sending malicious requests without logging in or going through any other authentication step, executing arbitrary code on the server. That raises the risk that information stored on a website could be leaked or that the server could be seized by the attacker.
The PHP Foundation had earlier detected irregularities related to PHP while following up on an external security audit conducted in 2024 with support from Germany's Sovereign Tech Agency. But it could not identify a specific path that could be exploited in an actual attack, and the fix drifted for a long period amid compatibility problems with existing programs, delayed decision-making among developers and a shortage of specialized personnel.
The situation changed abruptly once it was confirmed that the defect could be exploited in real hacking attempts. U.S. security firm Calif, OpenAI and cloud security firm Wiz each used artificial intelligence to analyze PHP code in August and reported vulnerabilities enabling remote code execution to PHP developers. The PHP Foundation then spent about two months developing and verifying security patches in private with outside researchers and software distributors, out of concern that hackers could exploit the flaws if details were disclosed first.
The episode is drawing attention because it shows how advances in AI can accelerate the discovery of vulnerabilities long latent in software. Park Se-jun, chief executive of cybersecurity firm Theori, said considerable expertise and time were once needed to understand complex code structures and find vulnerabilities, but that AI is rapidly lowering that technical barrier to entry. "If you instruct AI to analyze a particular piece of code and look for vulnerabilities, it can search for related problems and automatically carry out testing and verification as well," the CEO said, adding that similar cases are likely to become far more frequent as vulnerabilities can now be found with relatively little knowledge.
A significant number of domestic web services may also be exposed. Small and midsize websites that have been running for years often have not been updated for security in time. Among services in South Korea, 89% run PHP 8.1 or earlier versions for which official security support has ended, according to U.S. cybersecurity firm Mallory. That is higher than in other major countries, including Germany at 57%, the U.S. at 71% and Japan at 79%. AhnLab, using an internet asset search service, also found that about 110,000 servers in South Korea are estimated to be running outdated PHP versions, the sixth-largest total in the world.
Because the website-building tools used by many corporate homepages and shopping malls, as well as some public agencies, schools, hospitals and other medical facilities, are PHP-based, there are concerns about cascading damage across both the public and private sectors. In Europe and Japan, authorities have already urged institutions and companies using PHP to take immediate security measures while launching sweeping website shutdowns as a precaution. U.S. security firm Cloudflare said it had detected early attack attempts targeting the vulnerabilities. An industry official said that if immediate patching is difficult, organizations should block external access, reduce unnecessary systems over the longer term to minimize their attack surface, and build a round-the-clock security inspection system using AI.