South Korea Raises Cyber Alert Over Critical PHP Flaws

The Ministry of Science and ICT raised South Korea's national cyber crisis warning level to caution on October 22, 2026, following the discovery of two critical vulnerabilities in the PHP programming language. Known as PHP2Shell, the flaws (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution, which could grant attackers full control over web servers. Researchers from Wiz and Calif used AI to uncover the vulnerabilities, which received a critical severity score of 9.2/10.

In response to the threat, the Office of National Security convened an emergency meeting to coordinate patching efforts across the defense, public, and private sectors. The Korea Internet & Security Agency issued advisories urging users to update to PHP versions 8.2 through 8.5 and migrate away from unsupported versions 8.1 and earlier.

AhnLab estimated that South Korea has 110,000 vulnerable hosts, the sixth-highest number in the world. This exposure leaves small and medium-sized enterprises particularly at risk. The PHP Project released security patches for the vulnerabilities on October 21, one day before the South Korean government's alert.