South Korea Urges PHP Updates as Two Flaws Trigger International Security Response

Emergency fixes target two weaknesses in widely used web software

South Korea's Korea Internet & Security Agency (KISA) urged website operators to update PHP on October 21, 2026, after two security weaknesses were identified in software used to run login pages, shopping services and discussion boards. The reported risks include attackers running code on a server without first logging in.

KISA identified the vulnerabilities as CVE-2026-109618, involving improper handling of exceptional conditions, and CVE-2026-109619, involving the use of memory after it has been released. Its update thresholds cover four PHP release branches: 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

South Korea's Ministry of Science and ICT and KISA followed with security requests on the night of October 21 to businesses and institutions in national cybersecurity networks. Government authorities described that outreach on October 22. Emergency assistance to help smaller businesses install patches was under consideration.

The weaknesses, collectively described as PHP2Shell, prompted an international response. Some government institutions in the Netherlands and Finland reportedly suspended websites as a precaution, while cybersecurity authorities in Europe, Japan and Australia urged updates. US agencies also reportedly advised taking affected systems offline when immediate patching was impossible.

Which PHP versions need attention?

KISA's advice sets a different minimum version for each affected PHP branch. A branch is a family of releases: a website using PHP 8.3, for example, needs the corrected release within that family or an appropriate newer supported version.

• PHP 8.2: update versions earlier than 8.2.35.
• PHP 8.3: update versions earlier than 8.3.36.
• PHP 8.4: update versions earlier than 8.4.27.
• PHP 8.5: update versions earlier than 8.5.12.

KISA also warned that PHP 8.1 and earlier versions had reached the end of official security support. Operators using those releases were advised to move to a supported version, rather than remain on software whose official security maintenance had ended.

For a business owner, the practical starting point is the PHP version running on the website's server. A hosting company may manage that software, or responsibility may sit with an internal technology team. Updating a laptop browser changes a different part of the system.

What the two flaws could allow

CVE-2026-109618 concerns exceptional conditions, situations in which software encounters something outside its normal operation. Programs need to handle those situations safely. A failure in that handling can leave the software behaving in an unintended way.

CVE-2026-109619 is described as a use after free vulnerability. Software temporarily reserves areas of computer memory and releases them when finished. This type of flaw occurs when a program later tries to use an area it has already released, potentially accessing data that has changed or belongs to another operation.

The reported danger is unauthenticated remote code execution. In everyday terms, someone outside a website could potentially make its server run instructions without supplying a valid username or password. A successful attack could expose information, install malicious software or interrupt services.

The precise server configurations and request conditions needed to exploit each weakness were not specified in the announcements described publicly. Operators therefore need to check the affected software versions and obtain technical guidance for their own installations.

Why WordPress puts the issue within reach of ordinary businesses

PHP runs on a website's server rather than on a visitor's phone or computer. When a shopper asks to see an order history, a PHP program can retrieve the relevant records from a database and prepare the page sent back to the browser. Login systems, comments and message boards can work in the same way.

WordPress, which provides tools for creating and managing websites, also runs on PHP. That connects the security response to blogs, company websites and online shops whose owners may rarely interact directly with the underlying programming language.

Figures attributed to web technology measurement service W3Techs put PHP usage at about 75% among websites whose server programming language can be identified. WordPress accounts for about 43% of all websites. The PHP figure uses a narrower measurement group than the WordPress figure: websites with an identifiable server language, rather than every website.

Those figures explain the breadth of the response. Many independently operated websites depend on the same underlying software, so one repair campaign can involve public institutions, large companies and small businesses at the same time.

South Korea reaches businesses through two security channels

The Ministry of Science and ICT and KISA directed their October 21 requests to members of C-TAS, a system for analysing and sharing cyber threat information, and to companies required to register a chief information security officer, or CISO.

C-TAS has about 5,900 participating companies and institutions. Around 30,000 companies are required under South Korea's information and communications network legislation to designate a CISO and notify the ministry. A CISO is the senior official responsible for an organisation's information security.

The two figures describe different outreach groups, with possible overlap between them. The government also used KISA's public cybersecurity portal, known as Boho Nara, to recommend security updates and patch installation.

Smaller businesses face a practical staffing problem: some lack employees who can identify an affected installation, arrange an update and check that the website still works afterward. A ministry official said the government had first distributed security guidance and was considering emergency patch assistance. No launch date or eligibility rules for that assistance were announced.

How the response developed

The reported sequence stretches back to an external security audit in 2024 and leads to an accelerated release of fixes in October 2026. The key dates are:

• 2024: An external audit reportedly identified signs of some defects. Internal disagreement and concerns about compatibility with existing software were cited as reasons patch development did not proceed then.
• October 21, 2026: PHP developers reportedly released fixes for two vulnerabilities, and KISA issued update advice.
• Night of October 21: South Korean authorities sent security requests through business and institutional channels.
• October 22: South Korean authorities described the outreach. This was also the originally planned patch release date.

The patches were reportedly brought forward by one day after information about the vulnerabilities leaked. Attack attempts had also reportedly been detected before the fixes became public, adding pressure on operators to act quickly.

The account of the 2024 audit also points to a maintenance challenge. A change to shared software can affect applications built around its existing behaviour. Compatibility concerns can make repairs harder to coordinate, especially when a language supports many different websites and hosting arrangements.

AI discovery and independent security research

Cybersecurity company Calif reportedly identified the vulnerabilities using an OpenAI model described as GPT-5.6 Sol. The defects were described as having escaped identification for more than a decade.

Google affiliated cybersecurity company Wiz reportedly found and submitted the two vulnerabilities independently. Wiz cofounder Ami Luttwak described them as the most serious vulnerabilities discovered using AI and said their complexity would have made discovery extremely difficult without it.

OpenAI said it had spent the preceding two months coordinating researchers and cybersecurity companies to support the response. It also predicted a sharp increase in similar discoveries using AI over the following months.

The immediate work for website operators remains concrete: identify the installed software, apply the appropriate correction and keep services functioning. The use of AI in discovery adds another part to the story, alongside independent research, developer coordination and the distribution of patches.

Why some authorities recommended going offline

The US National Security Agency reportedly urged organisations using PHP to update immediately, warning that exploitation could give attackers access to a server's file system or database. It recommended taking affected systems offline until the weaknesses were resolved if immediate updates were impossible.

The FBI reportedly issued similar advice, warning about remote code execution and possible exposure of sensitive information and networks. Some Dutch and Finnish government institutions suspended websites as a preventive measure.

Taking a website offline has an immediate cost: visitors lose access to the services it provides. For a shop, that may mean interrupted sales; for a public institution, unavailable information or online forms. The recommendation reflects the seriousness of allowing an exposed server to remain reachable while awaiting a repair.

Cloudflare said it was updating protective measures to match the attack routes. Website operators still received advice to install the PHP fixes, bringing the underlying software up to the versions identified in the security response.

What operators need to do now

Website operators should establish who controls their PHP installation and compare its version with KISA's listed thresholds. Organisations using a hosting provider need that provider to confirm the server version and update arrangements. Teams managing their own servers need to handle the change directly.

Businesses running WordPress should include the PHP runtime in that check, alongside their normal website maintenance. PHP is a separate software layer beneath the content management system, so knowing the WordPress version alone leaves part of the installation unaccounted for.

Operators using PHP 8.1 or earlier face a move to a supported release. Those already using an affected branch need the relevant corrected version or a suitable newer supported release. Testing essential functions such as customer login, order retrieval and payments helps identify service problems during the update.

Key Points

• KISA issued PHP security update advice on October 21, 2026, identifying CVE-2026-109618 and CVE-2026-109619.
• The listed update thresholds are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
• KISA advised users of PHP 8.1 and earlier to move to a supported version.
• The reported risks include attackers executing code remotely without logging in.
• South Korea contacted security network members and companies required to designate a CISO.
• Emergency patch assistance for smaller South Korean businesses was under consideration.
• International authorities urged updates, with some recommending temporary shutdowns when immediate patching was impossible.