Ministry of Science and ICT urges companies to take emergency action over critical PHP vulnerabilities

Ministry of Science and ICT issues emergency notice to corporate CISOs

Korea Internet & Security Agency recommends updating to latest PHP version

Cafe24, cybersecurity firms roll out emergency security measures

A file photo of a hacker [Getty Images Bank]

The South Korean government has launched an emergency response after critical security vulnerabilities were discovered in PHP, a programming language widely used across websites worldwide.

South Korea's Ministry of Science and ICT on Thursday urged chief information security officers at companies to take emergency security measures to prevent incidents stemming from the PHP vulnerabilities.

The ministry ordered companies to prepare swift countermeasures against the PHP security flaws and said it plans to continuously monitor threat trends and check response progress.

The Korea Internet & Security Agency also issued a security notice on Wednesday, recommending that "users running affected versions update to the latest version in accordance with the provided solutions."

According to the agency, two vulnerabilities were identified: an improper handling of exceptional conditions flaw (CVE-2026-109618), which fails to properly process exceptional situations, and a use-after-free vulnerability (CVE-2026-109619), which references memory that has already been released.

Four PHP versions are affected: 8.2, 8.3, 8.4 and 8.5. Users running versions below 8.2.35, 8.3.36, 8.4.27 and 8.5.12, respectively, are exposed to the vulnerabilities.

The agency stressed that PHP version 8.1 and below have already reached end-of-life for official security support, and that users must upgrade to a supported version.

[Provided by the Ministry of Science and ICT]

Companies in related sectors — including website operators and AI security solution providers — have also moved quickly to respond.

Cafe24, which supports the operation of websites including online shopping malls, began emergency security work on Wednesday.

The company applied a security measure across all services running PHP 5.4 and above, disabling the session upload progress tracking feature (session.upload_progress.enabled).

"A wide range of versions from the PHP 5 series through the PHP 8 series have been reported as affected," Cafe24 said in a notice, adding that it was applying a temporary fix on an emergency basis to protect customer services.

However, Cafe24 told its customers that "this measure is a temporary step to mitigate the risks posed by the vulnerability," and recommended that they "migrate (upgrade) PHP to the latest version for stable protection."

Cybersecurity firm Everspin said it had applied blocking rules to its Eversafe for Web SaaS customer service using a vulnerability attack response feature to stop the relevant attacks.

PHP, in which the vulnerabilities were found, is a server-side programming language used across a wide range of web services, including corporate websites, content management systems and e-commerce platforms. PHP's own assessment rated the severity at CVSS 9.2, placing it in the Critical rating.

The security flaws allow an outside actor to execute arbitrary code or take control of a system without any login or authentication process. The vulnerabilities were discovered with the help of AI and are assessed to be security flaws that went undetected for more than a decade.

sjpark@heraldcorp.com