A critical security vulnerability has been discovered in PHP, a programming language widely used across websites globally, allowing external attackers to execute arbitrary code without requiring any login or authentication.
The Korea Internet & Security Agency (KISA) has strongly urged PHP users and website administrators to apply security updates immediately.
According to KISA, the identified issues consist of two vulnerabilities: an ‘improper handling of exceptional conditions’ flaw (CVE-2026-109618) and a ‘use-after-free’ flaw (CVE-2026-109619).
The affected products include PHP versions 8.2, 8.3, 8.4, and 8.5.
Specifically, websites utilizing PHP versions lower than 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are exposed to potential attacks.
KISA has advised updating each version to its respective security release or higher.
In particular, the agency emphasized that since official security support for PHP version 8.1 and below has already ended, administrators must upgrade to currently supported PHP versions rather than simply applying patches.
This vulnerability is known to potentially allow attackers to execute arbitrary code remotely and seize control of systems without passing through any login or authentication procedures.
The overall impact is expected to be substantial.
According to web technology analysis firm W3Techs, approximately 75% of all websites with identifiable programming languages use PHP.
Furthermore, WordPress—a content management system (CMS) utilized by roughly 43% of all websites—also operates on PHP.
Following the vulnerability disclosure, international entities have also initiated emergency responses.
Government agencies in several European nations, including the Netherlands and Finland, temporarily suspended website operations as a preventive measure.
Cybersecurity authorities in Europe, Japan, Australia, and other regions have similarly advised relevant system administrators to implement emergency security updates.
Website administrators must verify their current PHP versions and promptly upgrade to the latest secure versions if vulnerable releases are in use.
