South Korea Raises Cyber Alert as Critical PHP Flaws Hit Websites Worldwide

Science Minister Bae Kyung-hoon said in a release that the PHP flaw “could affect a number of websites and requires an urgent response as exploit codes have already been made publicly available,” according to Yonhap. The level is second lowest in South Korea’s four-tier system, and the Korea Internet & Security Agency issued a security update advisory.

Ifanr reported that Finland’s transport and communications agency suspended some online services; the Netherlands’ DigiD, MijnOverheid and government portal went offline, and the Dutch national cyber security center’s own site temporarily closed; Japan’s pixiv, Niconico and BOOTH announced emergency maintenance; Sushiro said its mini-program was suspended for system maintenance.

PHP developers released updates 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21. The flaws, CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2 and can be exploited remotely without credentials, according to ifanr. Researchers nicknamed them PHP2Shell because an attacker could gain a shell on a server; in common Apache deployments, the attack triggers before the site’s own code runs. The ministry said attackers could control affected servers without authentication and cause data leaks, shutdowns or defacement.

PHP powers WordPress, Wikipedia’s MediaWiki, Drupal, Joomla and Magento. W3Techs data cited by ifanr showed 69.3 percent of sites with identifiable server-side technology use PHP, versus 8.1 percent for JavaScript. Wiz, one of the firms that found the flaws, said even a site running only “Hello World” would be affected. Patches cover PHP 8.2 through 8.5, while 27.0 percent of PHP sites still ran PHP 7.x and 7.7 percent PHP 5.x the same day, branches without official patches. Forensics expert Hal Pomeranz said too many embedded installations would never be patched and too many forgotten applications lacked maintenance, according to ifanr.

The disclosure process broke down. Ifanr reported that details were due for coordinated release on Oct. 22, but a Hacker News post on Oct. 20 claimed two PHP remote-code-execution flaws rated 10.0. The post was deleted but screenshots spread; watchTowr confirmed the leak within hours and reproduced one flaw. PHP’s security team moved the release forward by 24 hours. Calif mistakenly posted a demonstration video showing exploit code working, and Chainguard broke an embargo and published fixed images. The PHP Foundation later said it was angry about the disclosure, ifanr reported.

The accounts differ on timing. Yonhap said the flaw was discovered on Wednesday and came to light through artificial intelligence, with Wiz calling the vulnerabilities the most severe ever detected by AI. Ifanr reported the flaws were found in August. OpenAI said Calif researchers used GPT-5.6 Sol to find a key defect; Calif said Ryan Austin was the first to discover it and produce working exploit code, citing an Aug. 5 post with a discovery hash. Austin wrote that the initial discovery did not rely on a special tool framework or a model unavailable to the public, and that knowledge of the target’s history guided the search. The PHP Foundation confirmed OpenAI’s team independently reported the same root cause on Aug. 11, and Wiz independently found the flaws on Aug. 19 using Wiz Atlas with Gemini 4 Argon and GPT-5.6 Sol, then verified unauthenticated remote code execution on official Drupal and WordPress images, according to ifanr. Calif CEO Thai Duong told The Wall Street Journal that such risks had long been considered too difficult to exploit. Wiz co-founder Ami Luttwak compared the episode with Heartbleed and Log4Shell.

Cloudflare said its WAF rules were enabled by default for all customers and introduced “full-transaction detection” to correlate requests with origin responses; it observed attack traffic and changing payloads the same day, ifanr reported. OpenAI open-sourced a Codex Skill to check sites for php2shell, with phpcheck-server for server access and phpcheck-url for URL-only checks. Website operators must upgrade, restart all PHP processes and migrate or isolate old versions that cannot receive patches, ifanr reported. OpenAI acknowledged that the same capability helping researchers find severe defects could help attackers build tools faster, according to ifanr.