Two critical PHP flaws prompt urgent warnings and South Korean government alert

Security firms and officials in South Korea and abroad urged quick action over two critical vulnerabilities in PHP, a programming language widely used to build websites. Newsis and Dong-A Ilbo reported on 21 October that the PHP security team planned to release an update fixing the two flaws at 23:00 Korean time that day. Each flaw scores 9.2 out of 10 under CVSS 4.0, the 'Critical' level. [ 1 , 2 ]

The flaws are CVE-2026-109618 and CVE-2026-109619, which the security industry also calls PHP2Shell. They are known as remote code execution vulnerabilities that let an outside attacker run arbitrary code on a server. A successful attack could lead to stolen information or altered website content. The security team asked operators to prepare to apply the update as soon as it appeared, and said the specific details, affected versions and fixed versions would be announced with it. [ 1 , 2 ]

CERT-EU, the cybersecurity response body for EU institutions and agencies, advised identifying websites and services run on PHP and preparing security updates. Where immediate action is difficult, it said, operators should consider blocking external access to the service until the update is applied. Wordfence stressed that WordPress's own updates are separate from PHP security updates and told operators to check their PHP version and their hosting provider's update plans. In South Korea, AhnLab warned of the remote code execution risk in an urgent notice but said the official scope of impact had not yet been provided. [ 1 , 2 ]

Yonhap reported on 22 October that the Ministry of Science and ICT and the Korea Internet and Security Agency (KISA) asked members of the C-TAS threat-sharing system and companies obliged to report a chief information security officer to take security measures. KISA operates C-TAS, which has about 5,900 participating firms and institutions, and about 30,000 companies are obliged to make such a report. KISA's 'Boho Nara' portal also issued a notice recommending updates and patches. Yonhap said the flaw can be exploited without login or authentication and that the PHP developers released new versions fixing the two flaws on 21 October (local time). [ 3 ]

Yonhap said security industry figures argue that small firms with limited security staff may struggle to patch quickly and that the government should arrange practical help such as emergency patch support. A ministry official said it had first informed the relevant companies and that emergency patch support for small and medium-sized firms is under review. Citing W3Techs, Yonhap said about 75% of websites whose programming language can be identified use PHP, and WordPress, used on about 43% of all websites, also runs on it. It added that the security firm Kaelipeu (캘리프) is said to have found the flaws using OpenAI's GPT-5.6 Sol model. [ 3 ]

Dong-A Ilbo quoted Park Se-jun (박세준), chief executive of Theori (티오리), who wrote on Facebook that many Korean sites, such as those using the Gnuboard (그누보드) bulletin board tool or older shopping malls, run old PHP versions such as 5 and 7. He said forgotten sites, outsourced shopping malls and equipment management pages may also run PHP, and advised applying the patch at once or temporarily blocking external access. LogPresso said turning off the file upload progress feature could reduce some risk until the patch, and advised checking server records for abnormal PHP crashes, web shells and suspicious outside communication. Dong-A Ilbo added that versions past PHP's official support period receive no official security fixes. [ 2 ]