Cybersecurity agency calls for immediate PHP updates over critical security flaws

Critical security vulnerabilities that could allow hackers to take control of websites without authentication have been discovered in PHP, a programming language widely used by websites around the world, with the Korea Internet & Security Agency (KISA) calling for immediate security updates.

One vulnerability, known as CVE-2026-109618, involves the improper handling of unexpected errors, while the other, known as CVE-2026-109619, occurs when a program attempts to access memory that has already been released.

Attackers can reportedly exploit the vulnerabilities to remotely run arbitrary code or take control of affected systems without requiring login credentials or authentication.

The vulnerabilities affect PHP versions 8.2, 8.3, 8.4 and 8.5, and systems running versions earlier than PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 may also be vulnerable to attacks. KISA urged internet users to update their PHP installations to the corresponding patched versions or later releases.

The agency emphasized that users running PHP 8.1 or earlier should upgrade to a currently supported version rather than simply applying patches, as official security support for those versions has already ended.

The potential impact could be widespread. Around 75 percent of websites worldwide — whose server-side programming language can be identified — use PHP, according to web technology analytics firm W3Techs. WordPress, a content management system used by approximately 43 percent of all websites, also runs on PHP.

Overseas authorities have also taken emergency measures after the vulnerabilities were disclosed.

Government agencies in some European countries, including the Netherlands and Finland, have reportedly temporarily suspended their websites as a precaution. Cybersecurity authorities in Japan, Europe and Australia have also advised system administrators to apply urgent security updates.

Website administrators are advised to check which PHP version they are running and upgrade to the latest secure release as soon as possible if their systems are affected.

BY JEONG JAE-HONG [[email protected]]