Gov'ts scramble to patch websites after AI uncovers hidden PHP flaws 

Korea raised its cyber threat level on Thursday after AI uncovered serious security flaws in PHP, a programming language used by most of the world’s websites.

Ministry of Science and ICT and the Korea Internet & Security Agency moved its private-sector cyber crisis alert from “attention” to “caution,” the second of Korea’s four cyber crisis levels, after PHP developers disclosed two security vulnerabilities in the United States a day earlier.

PHP is a programming language used to build websites, especially pages that change based on who is visiting, like a shopping cart or a login page. Created in the mid-1990s, it now powers about 70 percent of websites whose programming language can be identified, according to web technology tracker W3Techs, including WordPress, the software behind about 40 percent of all websites.

“This vulnerability could allow [attackers] to take control of servers without authentication, and attack attempts have already been reported overseas,” Song Ki-ho, third deputy national security adviser, said. “The scale of the damage will depend on how quickly we act. We need to respond swiftly as one team.”

Korean authorities have launched an emergency response system. Authorities have assigned more personnel to handle possible breaches, and emergency response teams are on standby.

The alert followed a disclosure by PHP developers on Wednesday that an internal security audit had uncovered vulnerabilities. Developers released emergency fixes for the flaws.

One loophole, dubbed PHP2Shell, could let malicious hackers remotely execute arbitrary code without login or authentication and compromise a website within seconds.

The U.S. National Security Agency issued a security advisory on Wednesday and urged organizations to apply the relevant patches. The agency recommended temporarily taking systems offline if immediate updates were not possible.

Several European government bodies, including the French Interior Ministry and the Dutch National Cyber Security Centre, temporarily blocked access to websites, Reuters reported.

Korea may face particular exposure because many servers are believed to still run older versions of PHP that no longer receive security updates.

About 25,000 Korean servers were running PHP 8.1 or older, accounting for 82 percent of the servers whose PHP versions could be identified, according to French cybersecurity company CybelAngel. Versions 8.1 and earlier no longer receive official updates, so users must upgrade to PHP 8.3 or later to apply the newly released security patches.

The Science Ministry advised companies and institutions using PHP to check the versions running on all websites and systems and update them immediately.

Organizations unable to update their systems were advised to block external access or temporarily shut down their websites.

“A rapid response is necessary as this could lead to damages such as personal information data breach or website defacement,” Science Minister Bae Kyung-hoon wrote on Facebook.

The most striking part of the episode is how the flaws were found.

An AI tool identified vulnerabilities that had remained hidden in the PHP source code for years despite repeated human review.

Cybersecurity company Calif used OpenAI’s GPT-5.6 Sol during an OpenAI-supported security audit of the PHP source code in August and uncovered the flaws.

The vulnerabilities had remained buried in PHP’s source code for years, but security specialists had taken no separate action, deeming the flaws “too technically complex to be practical for real-world attacks.”

But once AI showed that the flaw could actually be exploited to hack websites, alarm bells started ringing.

Developers had spent two months racing to patch it for Thursday's release — only for details to leak on developer communities on Tuesday and force the release to be moved up a day.

This loophole was “the most severe AI vulnerability that was ever found,” according to Ami Luttwak, co-founder of Google’s Wiz cybersecurity team, which helped identify the PHP bug.

Cybersecurity experts expect AI to find such holes faster — and more often.

Some AI developers, including OpenAI and Anthropic, have recently delayed releasing their most advanced frontier models over concerns that they could be misused for cyberattacks.

“As more open-source AI models [models that make source code or weights publicly available] are developed, the speed at which vulnerabilities can be found will increase even without the very top AI models, and as will the attempts to exploit them,” Yoon Doo-sik, CEO of cybersecurity company eRoun&Company, said.

The episode has also fueled calls for the Korean government to take more proactive measures, including a comprehensive review of vulnerable websites.

“Many companies do not even have a full grasp of which servers they are operating,” Prof. Kim Seung-joo at Korea University’s School of Cybersecurity said. “A comprehensive inspection is needed to prevent security incidents before they happen.”

BY SUNG JI-WON [[email protected]]