A global cybersecurity emergency has erupted as 70 percent of websites worldwide face unprecedented hacking threats. The crisis was triggered when artificial intelligence discovered zero-day vulnerabilitiesβpreviously undisclosed security flawsβthat human security professionals had missed. Governments across the globe have scrambled to implement emergency blocking measures, including taking vulnerable websites offline.
The Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) raised the civilian cyber crisis alert level for PHP from ‘Interest’ to ‘Caution’ in response to two security flaws disclosed by PHP developers. Authorities have reinforced cyber intrusion response teams and placed emergency dispatch units on 24-hour standby. At an emergency civil-military-government cyber security meeting held by the National Security Office, officials emphasized that rapid response is critical to minimizing scale of damage as overseas attack attempts are already being reported.
PHP is a widely used programming language powering websites and online shopping malls. According to U.S. web technology analytics firm W3Techs, approximately 70 percent of websites worldwide utilize PHP. The crisis came to light when PHP developers disclosed security flaws identified during internal audits and urgently released patched code. Exploiting this vulnerability, dubbed ‘PHP2Shell,’ hackers can remotely execute arbitrary code within seconds without login or authentication procedures.
Governments worldwide have taken urgent action. The U.S. National Security Agency (NSA) issued an advisory urging agencies to apply relevant security patches and recommended taking systems offline temporarily if immediate updates are not feasible. According to Reuters, several European government entities, including the French Ministry of the Interior and the Dutch National Cyber Security Centre, also temporarily shut down their website operations.
Despite government interventions, concerns are mounting in South Korea as numerous websites reportedly run outdated versions that do not support security updates.
AI Uncovers Deep-Seated Zero-Day Flaws
According to French security firm CybelAngel, approximately 25,000 servers in South Korea run outdated PHP versions 8.1 or lower, accounting for 82 percent of servers where versions could be identified. Because official updates are not provided for version 8.1 and below, administrators must upgrade to version 8.3 or higher to apply the disclosed security patches. The Ministry of Science and ICT advised companies and institutions using PHP to verify the versions across all operating systems and immediately switch to the latest versions. If updates are difficult, authorities recommended blocking external access or temporarily suspending sites.
This crisis is evaluated as more critical because an AI model uncovered vulnerabilities that humans failed to find for years. Cybersecurity firm Caliph utilized OpenAI’s frontier model ‘GPT-5.6 Sol’ during an OpenAI-supported source code security audit in August, uncovering the vulnerability. The flaw had remained hidden in the PHP source code for years. Related security personnel had spotted the problematic code years ago but dismissed it as a standard vulnerability unlikely to be exploited for hacking. However, panic ensued after AI demonstrated that the code could indeed be leveraged for attacks. Although developers spent two months refining the code and planned to release the security patch, the deployment schedule was accelerated by a day after information leaked on developer communities prematurely.
Growing Concerns Over AI-Driven Cyberattacks
Security industry experts project that AI will find zero-day vulnerabilities increasingly faster and make attacks easier. Yoon Doo-shik, CEO of cybersecurity firm Eλ‘μ΄&Company, noted that the proliferation of open-source AI models will lower the barrier to entry, enabling attackers to locate vulnerabilities without relying on top-tier models.
Consequently, experts argue that governments must take proactive measures such as conducting comprehensive website surveys. Kim Seung-joo, a professor at Korea University’s Graduate School of Information Security, pointed out that many companies fail to accurately track the servers they operate, stressing the importance of comprehensive investigations to preemptively prevent security incidents.
