The South Korean government will draw up a comprehensive, cross-ministry response after critical security flaws were found in PHP, the programming language used by more than 70% of websites worldwide, prompting emergency measures by governments around the world.
"I deeply share the view that the cybersecurity command structure needs to be overhauled," Deputy Prime Minister and Science and ICT Minister Bae Kyung-hoon said on the 23rd at a comprehensive parliamentary audit held by the National Assembly's Science, ICT, Broadcasting and Communications Committee in Seoul. "Beyond a response centered on the National Security Office, we are reviewing a comprehensive cross-ministry plan and a related reorganization." Bae added that measures are needed that go beyond the PHP issue to address the root causes, and said he would report on the plans soon.
PHP developers released emergency security updates on the 21st to fix two vulnerabilities, dubbed "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619), that allow outside attackers to execute arbitrary code on a server without any authentication. Both flaws scored 9.2 out of 10 under version 4.0 of the Common Vulnerability Scoring System (CVSS), placing them in the highest risk tier, "Critical."
Choi Woo-hyuk, head of the ministry's information protection and network policy office, said the ministry issued a security notice at about 11:20 p.m. on the 21st, the day the PHP Foundation made its announcement, and raised the cyber crisis alert level from "attention" to "caution" the following day, asking 28,000 chief information security officers (CISOs) and 111 major infrastructure facilities to apply the patch.
Lee Sang-joong, president of the Korea Internet & Security Agency (KISA), said public administrative agencies mostly do not use PHP, but added that the number of systems still running vulnerable PHP versions and the patch completion rate have yet to be determined. He also said KISA has no authority under current rules to scan systems directly.