South Korea raises cyber threat level over PHP vulnerabilities

The South Korean government has raised the cyber threat alert level for the private sector to ‘Caution’ following the discovery of two critical security vulnerabilities in PHP. PHP is an open-source programming language used by approximately 70% of websites globally and roughly 80% of domestic websites in South Korea.

The vulnerabilities, which received a high risk score under the Common Vulnerability Scoring System (CVSS 4.0), could allow hackers to bypass authentication and execute arbitrary commands remotely without a username or password. Such exploits could lead to the planting of malicious scripts, customer data leaks, and service disruptions.

In response, the Ministry of Science and ICT has activated an emergency response system and issued guidance for applying security patches. During a National Assembly audit, officials discussed the need for more integrated government-wide organizations to manage cyber threats and improve the effectiveness of information protection policies.