PHP security flaws trigger global cyber alert | The DONG-A ILBO
Editions
PHP security flaws trigger global cyber alert
- listen
- Font size down
- Font size up
Posted October. 23, 2026 08:57,
Updated October. 23, 2026 08:57
- listen
- Font size down
- Font size up
한국어
A critical security flaw in PHP, a programming language used by about 70% of websites worldwide, has triggered urgent cybersecurity measures in multiple countries. The discovery of vulnerabilities that had gone undetected for years has raised fears that hackers could exploit them rapidly using AI-powered tools. The prospect of AI systems racing to identify and exploit security gaps has fueled warnings of an impending “Bugmageddon,” a blend of “bug” and “Armageddon.”
Cybersecurity experts said Oct. 22 that two vulnerabilities in PHP could allow hackers to execute malicious commands on web servers remotely without logging in. PHP is widely used to power website functions such as online shopping and user logins. According to W3Techs, an Austrian firm that tracks web technologies, PHP runs about 70% of websites worldwide for which the server-side programming language can be identified. Exploiting the flaws could expose personal information stored on servers or allow attackers to manipulate websites.
Attempts to exploit the vulnerabilities have emerged almost immediately after they became public. On Oct. 21, Amazon and Cloudflare reported detecting attempts to exploit the PHP flaws. Amazon is a U.S. technology company, while Cloudflare specializes in internet security services.
Governments and public institutions worldwide have taken steps to limit their exposure, with some shutting down websites entirely. The Port of Rotterdam, Europe’s largest port, took its website offline, as did government agencies and public institutions in Germany and France. The Wikimedia Foundation, which operates Wikipedia, the world’s largest online encyclopedia, also temporarily shut down some systems. The U.S. National Security Agency (NSA) and Federal Bureau of Investigation (FBI) issued urgent warnings, advising operators to take affected systems offline if they could not install security updates immediately.
South Korea’s Ministry of Science and ICT raised its cyber crisis alert for the private sector from “attention” to “caution” on Oct. 22 and activated its emergency response system. About 112,000 servers in South Korea may be running vulnerable versions of PHP, according to cybersecurity firm AhnLab, putting the country sixth worldwide in the number of potentially affected servers. The ministry also issued urgent security guidance to information security officers at about 28,000 companies and operators of 111 major information and communications infrastructure facilities. Bae Kyung-hoon, deputy prime minister and minister of science and ICT, called for an immediate response, noting that “exploit code has already been made public.”
PHP is a programming language used to build and run websites. It enables web servers to perform essential tasks, including processing and storing customer orders. First released in 1995, PHP now powers about 70% of websites worldwide.
박재명 기자 sunrise@donga.com
Most Viewed
- 1247회 로또 1등 각 36.3억씩…자동 5명·수동 3명
- 김민석 “수첩 안 찍히겠지 했는데”…장동혁 “국힘답지 않게”
- 김혜수, 이탈리아 여행서 드러낸 탄탄한 몸…평소 즐긴 ‘물속 운동’ 효과는
- “운동은 짧고 굵게, 매일 해야 100세까지 즐겁습니다”[양종구의 100세 시대 건강법]
Headline News
Scalpers profit as fans scramble for playoff tickets
Opinion
- EditorialNorth Korean IT infiltration exposes security gaps
- Op-edParliamentary audits must produce meaningful results
