The discovery of top-severity security flaws in PHP, a programming language widely used to build websites, has put the global information technology industry on alert. The flaws allow outside attackers to run malicious code on web servers without any authentication, raising concern that small online shopping malls and the websites of smaller companies, which tend to have weaker security management, could be exposed to hacking.
Two critical remote code execution (RCE) flaws have been found in PHP, prompting emergency security responses worldwide, according to the security industry on the 22nd. PHP is a programming language widely used in web development. About 70% of websites whose server-side programming language can be identified use PHP, according to web technology analytics firm W3Techs.
The U.S. National Security Agency (NSA) issued a formal advisory the previous day instructing all organizations and companies using PHP to apply emergency security updates. The agency warned that the flaws could provide a path to directly access a server's file system or database, and recommended taking affected systems offline until the vulnerabilities are fully resolved if immediate updates are not possible. The Federal Bureau of Investigation (FBI) also said hackers could exploit the PHP flaws to execute code remotely, pointing to the risk that sensitive information and networks could be compromised.
The two flaws are an improper handling of exceptional conditions (CVE-2026-109618), in which exceptions are not processed correctly, and a use-after-free issue (CVE-2026-109619), in which memory that has already been released is referenced again. Both score 9.2 out of 10 under version 4.0 of the Common Vulnerability Scoring System (CVSS), placing them in the highest risk tier of "critical."
PHP developers released emergency security patches addressing both flaws the previous day. Affected versions are PHP 8.2 below 8.2.35, 8.3 below 8.3.36, 8.4 below 8.4.27 and 8.5 below 8.5.12. Older versions of PHP 8.1 and earlier, for which official security support has ended, are also affected.
Korea has launched its own emergency response. The Korea Internet & Security Agency (KISA) issued a security update advisory for PHP products the previous day, urging users of affected versions to apply the latest security patches. It specifically recommended upgrading to a supported version for PHP 8.1 and earlier, for which official security support has ended. Domestic security firm AhnLab (053800.KQ) also issued an urgent notice warning of the remote code execution risk and calling for prompt security updates.
The bigger problem lies with smaller companies and small online shopping malls that lack security staff and capabilities. Security updates can be delayed when they manage servers on their own or run older versions of PHP. Websites that have gone unmaintained for long periods since they were built are especially at risk of operating with the flaws left unaddressed, requiring particular caution.
Park Se-jun, chief executive of cybersecurity firm Theori, wrote on Facebook the previous day that "in Korea, many sites remain stuck on PHP 5 or 7, such as those using the bulletin board tool Gnuboard or older shopping malls, so more caution is needed." Park added that "PHP may be hidden in sites built long ago and forgotten, shopping malls built by outside contractors, and equipment management pages," urging operators to check where the language is in use and apply updates and security patches immediately. Park also stressed that temporarily blocking external access should be considered if prompt patching is difficult.