South Korea’s government raised its private-sector cyber alert and coordinated patching measures after PHP disclosed two flaws that can enable unauthenticated remote code execution under certain conditions.
A presidential-office account, reported by ChosunBiz and Edaily, said the National Security Office held an emergency meeting Thursday, Oct. 22. Song Ki-ho, the office’s third deputy director, led the session, which brought together representatives of the National Intelligence Service, the Ministry of National Defense and the Ministry of Science and ICT.
The account said officials reviewed PHP use and repair progress across public agencies, businesses and military systems. They discussed applying fixes, temporary safeguards for sites unable to update promptly, checks for signs of intrusion and real-time threat sharing. Song said overseas attack attempts had been reported and urged a swift response, according to the account.
The Ministry of Science and ICT said it raised the alert at 11 p.m. EDT Wednesday, Oct. 21 (03:00 UTC Thursday, Oct. 22; noon KST Thursday). It said it was tracking attacks with security firms and would work with the Korea Internet & Security Agency (KISA) to inspect small and midsize companies and request fixes.
The PHP project released updates Wednesday, Oct. 21, for CVE-2026-109618 and CVE-2026-109619. Its advisory lists PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as fixed versions, and says installations handling web requests should be updated. EconoTimes previously covered PHP’s updates for the two critical flaws.
KISA said PHP 8.1 and earlier fall outside the project’s official security support and advised operators to move to a supported version. Cloudflare said the flaws affect PHP’s runtime, so changes to a website’s application code or add-ons will not address them. It also reported seeing attack traffic targeting customers while vulnerability details circulated before public disclosure; its account did not report confirmed breaches. The PHP project said temporary defenses leave some risk in place and that a fixed version is needed to resolve the vulnerabilities.
The presidential-office account, as reported by Maeil Ilbo, said the National Security Office would continue monitoring remediation and consider further measures as the work develops.
