South Korea Raises Cyber Alert Over Critical PHP Flaws

South Korea raised its national cyber crisis warning level on Thursday after critical vulnerabilities were identified in PHP, the widely used programming language behind a large share of websites and online services.

The Ministry of Science and ICT elevated the warning to “caution” at noon, placing the country at the second-lowest level in its four-tier alert system. The government asked companies and public agencies to install security updates and check systems that could be exposed to the flaws.

Science Minister Bae Kyung-hoon said an urgent response was required because exploit code targeting the PHP weakness had already been made public. Once such code is available, attackers can more easily test vulnerable systems and attempt intrusions before administrators complete updates.

The Korean action followed disruptions a day earlier, when government agencies and companies around the world shut down websites in response to the vulnerabilities. Researchers at cybersecurity company Wiz were among those who uncovered the flaws, which the company characterized as exceptionally severe. Artificial intelligence was used in the work that brought the vulnerabilities to light, adding a new dimension to the growing role of AI in both finding and exploiting software weaknesses.

PHP is used across a broad range of internet services, including online shopping platforms and major publishing systems. WordPress, the open-source content management platform used by many blogs and business websites, relies on PHP, as does Wikipedia. That reach means a weakness in the language can create risks across many organizations rather than within a single company or product.

Developers of PHP have issued patches intended to address the vulnerabilities. The Korea Internet & Security Agency also posted a security advisory, giving Korean operators a formal notice to update affected systems.

The higher alert does not indicate that every PHP-based website has been compromised. It signals that the combination of critical flaws, broad use of the software and publicly available exploit code warrants heightened monitoring and rapid remediation. Organizations will need to identify which versions they operate, prioritize internet-facing systems and confirm that patches have been applied successfully.

The episode also highlights how artificial intelligence is changing cybersecurity work. AI can help researchers identify dangerous flaws more quickly, but public disclosure and automated tools can also shorten the time defenders have before attackers begin probing unpatched systems. For South Korean agencies and businesses, the immediate task is therefore practical: update software, inspect exposed services and watch for signs of attempted exploitation.