A global cybersecurity emergency has broken out, leaving 70% of websites worldwide vulnerable to potential hacking attacks. This unprecedented threat emerged after artificial intelligence successfully uncovered zero-day vulnerabilities—previously unknown security flaws—that human security experts had failed to detect. Governments worldwide have scrambled to implement emergency defense measures, including taking vulnerable websites offline.
On Oct. 22, the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) raised the private-sector cyber crisis alert level from ‘Interest’ to ‘Caution,’ the second lowest on a four-tier scale (Interest, Caution, Warning, Serious), in response to two PHP security flaws disclosed a day earlier by the programming language’s developers. Authorities activated emergency response systems, increasing cyber-incident response personnel and placing emergency dispatch teams on standby. During an emergency civil-military-government cyber security meeting convened by the National Security Office at the Blue House, 3rd Deputy Director Song Ki-ho emphasized that the newly disclosed vulnerability allows hackers to compromise servers without authentication, with attacks already reported abroad, making rapid mitigation critical for limiting damage.
PHP is a widely used programming language for building homepages and online shopping malls. According to U.S. web technology analytics firm W3Techs, approximately 70% of websites globally utilize PHP. The crisis came to light on Oct. 21 when PHP developers announced they had discovered security flaws during a routine self-audit and urgently released a patched code. Named ‘PHP2Shell,’ the vulnerability can be exploited by hackers to remotely execute arbitrary code and breach websites in mere seconds without any login or authentication procedures.
Governments across the globe swiftly initiated emergency measures. The U.S. National Security Agency (NSA) issued a security advisory urging agencies to apply relevant security patches immediately, recommending that organizations temporarily take their systems offline if immediate updates were not possible. According to Reuters, multiple European government institutions, including the French Ministry of the Interior and the National Cyber Security Centre of the Netherlands, also temporarily shut down their website operations.
Despite government efforts, concerns are mounting domestically in South Korea as numerous sites continue running outdated, unsupported versions. According to French security firm CybelAngel, approximately 25,000 servers in South Korea run PHP 8.1 or older versions, accounting for 82% of servers where versions could be identified. Because versions 8.1 and below no longer receive official updates, administrators must upgrade to version 8.3 or higher to apply the security patch. The Ministry of Science and ICT strongly advised companies and institutions using PHP to verify all operating websites and systems and immediately upgrade to the latest version, or otherwise block external access and temporarily suspend sites. Science and ICT Minister and Deputy Prime Minister Bae Kyung-hoon stated via social media that swift action is vital to prevent customer data leaks and website defacements.
The incident has drawn heightened attention because an AI model uncovered a vulnerability that humans failed to locate for years. Cybersecurity firm Caliph utilized OpenAI’s frontier model, ‘GPT-5.6 Sol,’ during an OpenAI-supported security audit of PHP source code in August. The vulnerability had remained hidden within the PHP source code for years. Related security personnel had spotted the problematic code years ago but took no action, assuming it was too technically difficult to exploit for actual hacking. However, once AI demonstrated that the flaw could enable a cyberattack, a state of emergency was declared. Although developers spent two months refining the code and originally planned to release the security patch on Oct. 22 (local time), information leaked on developer communities two days prior on Oct. 20, forcing an accelerated release schedule. Amit Yoran, co-founder of Google-backed cybersecurity firm Wiz, noted that without AI assistance, the defect was far too complex for human eyes to ever discover.
Industry experts predict that AI will accelerate the discovery of zero-day vulnerabilities that elude human detection. Major AI developers, including OpenAI and Anthropic, previously delayed launching top-tier frontier models due to fears of security exploitation. Yoon Doo-shik, CEO of cybersecurity firm E로운&Company, forecasted that as open-source AI models continue to develop, attackers will find vulnerabilities faster and increase attack attempts even without utilizing the highest-tier models.
Consequently, experts argue that governments should execute proactive measures, such as conducting comprehensive nationwide web server audits. Professor Kim Seung-joo of Korea University’s Graduate School of Information Security pointed out that many companies fail to properly map out the servers they operate, emphasizing the need for comprehensive audits to preemptively prevent security incidents.
