The government raised the cyber crisis alert to “caution” as security vulnerabilities in the widely used website programming language PHP spread. The Ministry of Science and ICT urged companies and institutions operating PHP-based websites to apply security updates.

The industry said on Wednesday that PHP developers on Tuesday (local time) identified and fixed two “PHP2Shell” vulnerabilities that allow outside attackers to execute commands on servers without separate authentication, and distributed an updated version.

PHP is used across services including website management systems such as WordPress and Drupal, as well as homepages and online malls. The vulnerabilities were found using Calyphe’s OpenAI “GPT-5.6 Sol”, it said. The risk is high because attackers can execute commands on servers without separate authentication such as logging in.

The ministry and the Korea Internet & Security Agency (KISA) urgently circulated the information to about 28,000 companies that reported chief information security officers (CISOs), 111 major information and communications infrastructure facilities, 1,068 companies certified under the Information Security Management System (ISMS), and about 5,900 members of the Cyber Threat Analysis and Sharing (C-TAS) system.

The ministry recommended immediately updating to PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later. After updating, web services must be restarted so security measures take effect. In particular, users of PHP 8.1 or earlier, for which official security update support has ended, must switch to a supported higher version.

Even servers that have completed updates should check for signs of compromise such as abnormal access logs or whether webshells have been installed. Small business owners using web hosting firms can check with their providers on whether security updates have been applied.

The cyber crisis alert has four levels: attention, caution, alert and severe. The ministry will activate an emergency response system by increasing response staff and keeping emergency dispatch teams on standby around the clock following the issuance of the “caution” alert. It will also strengthen monitoring of attack trends in cooperation with the security industry.

Bae Kyung-hoon (배경훈), deputy prime minister and science minister, said, “This PHP vulnerability can affect countless homepages in Korea, and urgent action is needed as attack code has already been disclosed.” He added, “We plan to discuss security checks for small and medium-sized companies and requests for measures in cooperation with each ministry.”