South Korea raises cyber alert over critical PHP flaws found by AI
Synopsis
A pair of critical PHP vulnerabilities — the most severe ever detected by AI, according to cybersecurity firm Wiz — have triggered a global response, with South Korea raising its cyber crisis alert level and convening an emergency presidential security meeting. Exploit code is already public, meaning unpatched servers worldwide face an immediate, authentication-free takeover risk.
Key Takeaways
South Korea raised its cyber crisis alert to 'caution' on 22 October 2026 , the second lowest level in its four-tier system.
Two critical PHP vulnerabilities allow attackers to control web servers without authentication , enabling data theft, system shutdowns, and defacement.
Cybersecurity firm Wiz reportedly described the flaws as the 'most severe' ever detected using artificial intelligence .
Exploit codes were already publicly available at the time the alert was issued, heightening urgency.
Science Minister Bae Kyung-hoon called for urgent patching; KISA issued a security advisory.
The presidential office's National Security Office held an emergency meeting; public and military institutions were assessed as relatively secure due to low PHP usage rates.
South Korea's science ministry on Thursday, 22 October 2026 raised the nation's cyber crisis warning level to 'caution' — the second lowest in its four-tier system — as the country joined a global push to address two critical vulnerabilities in PHP, the programming language that underpins a vast share of the world's websites. The move came as exploit codes for the flaws were already circulating publicly, sharply raising the risk of large-scale cyberattacks.
What the PHP Vulnerability Involves
PHP, which stands for Hypertext Preprocessor, powers major platforms including Wikipedia, WordPress, and countless online shopping portals. The flaw, which came to light on Wednesday, could allow attackers to seize control of affected web servers without any authentication — enabling data theft, system shutdowns, and website defacement. Cybersecurity firm Wiz, whose researchers were among those who uncovered the vulnerabilities, reportedly described them as the 'most severe' flaws ever detected through artificial intelligence.
Government and Industry Response
Science Minister Bae Kyung-hoon underscored the urgency, stating: 'The flaw found in PHP could affect a number of websites and requires an urgent response as exploit codes have already been made publicly available.' Companies and government agencies were directed to apply patches immediately. The Korea Internet & Security Agency (KISA) issued a security update advisory to guide the patching process.
Emergency Meeting at the Presidential Office
The presidential office's National Security Office (NSO) convened an emergency meeting to coordinate the government's response. Officials reviewed PHP usage across the public, private, and defence sectors and committed to sharing threat intelligence and aligning response measures. Notably, public institutions and the military were assessed as relatively insulated from the threat, given their comparatively low rates of PHP adoption.
Global Context and Scale of the Threat
South Korea's escalation follows a day in which government agencies and companies worldwide took websites offline as a precautionary measure. The vulnerabilities were identified with the aid of AI, marking a significant moment in how critical security flaws are discovered. Developers of the PHP platform have since rolled out patches, but security experts warn that the window between public disclosure and mass exploitation is narrow — putting unpatched systems at immediate risk. This is the kind of supply-chain-level exposure that affects not just individual organisations but entire digital ecosystems simultaneously.
Point of View
And exploit code was publicly available almost simultaneously with the disclosure. South Korea's 'caution' tier is a measured response, but the global PHP ecosystem's long tail of unpatched, legacy deployments means the real damage window may stay open for weeks. The deeper issue is the concentration of internet infrastructure risk in a single language: when PHP sneezes, a significant portion of the web catches a cold. Policymakers globally should treat this as a stress test for coordinated patch-distribution pipelines, not just a one-off advisory moment.
NationPress
22 Oct 2026
Frequently Asked Questions
What is the PHP vulnerability that triggered South Korea's cyber alert?
The vulnerability is a critical flaw in PHP — the language powering platforms like WordPress and Wikipedia — that allows attackers to take control of web servers without any authentication. It was discovered using artificial intelligence and exploit codes were made publicly available almost immediately after disclosure, dramatically raising the risk of mass exploitation.
How serious is South Korea's 'caution' cyber alert level?
South Korea's cyber crisis system has four tiers; 'caution' is the second lowest. It signals a credible and active threat requiring immediate action from companies and government agencies, including mandatory system patching, but falls short of the top two emergency tiers reserved for confirmed large-scale attacks.
Who discovered the PHP vulnerabilities?
Cybersecurity firm Wiz was among the companies whose researchers uncovered the flaws, reportedly using artificial intelligence. The firm described them as the 'most severe' vulnerabilities ever detected by AI, underscoring both the scale of the risk and the growing role of AI in threat discovery.
What can attackers do if they exploit this PHP flaw?
Exploiting the vulnerability could allow attackers to control affected web servers without any login credentials. This opens the door to data leakage, complete system shutdowns, and website defacement — effectively giving an attacker full administrative access to a targeted site or service.
Have patches been released and what should organisations do?
Yes, PHP's developers have released patches to fix the vulnerabilities. The Korea Internet and Security Agency (KISA) has issued a security advisory urging immediate updates. Organisations globally are advised to apply the patches without delay, given that exploit code is already circulating publicly.
