AI-Discovered PHP Flaw Puts Global Websites on High Alert Over Hacking Risk

PHP Powers 70% of Websites, Prompting Government and Corporate Response

OpenAI’s ‘GPT-5.6 Sol’ Found the Flaw

Developers Released an Update

But Hackers Could Still Exploit Existing Weaknesses

Older Versions Account for 90% of Use in South Korea

Government Raises Cyber Alert to ‘Caution’

A vulnerability has been found in PHP, the programming language used by about 70% of websites worldwide, putting governments and companies on alert over potential security breaches. The flaw was discovered by U.S. security firm Calif using OpenAI’s advanced AI model GPT-5.6 Sol. PHP developers rushed out a security update, but concerns remain that hackers could target the weakness. Governments around the world have begun suspending online services and preparing countermeasures.

‘Millions of Attack Attempts After Disclosure’

According to the PHP Foundation and others on October 22, PHP developers announced a day earlier a security update fixing two vulnerabilities, dubbed PHP2Shell, that could allow attackers to remotely plant malicious code on servers. The update followed a report from Calif researchers in August and more than two months of verification work.

PHP sits between websites and the servers behind them, handling functions such as payments and orders for financial firms, online malls and corporate homepages. If PHP contains security flaws, hackers may be able to break in, steal data from servers, alter websites at will, or use compromised systems to control other companies’ servers.

The possibility of the flaw was first raised in 2024. At the time, it was considered unlikely to be exploited, and a fix was put on hold. That changed after AI identified it. The Wall Street Journal reported that Calif researchers used GPT-5.6 Sol to find two vulnerabilities in PHP and developed a security patch with PHP developers backed by OpenAI funding. Calif Chief Executive Thai Duong said the flaws had largely been forgotten because they were considered too difficult to exploit. He added that hackers could use AI to reverse-engineer the patch and launch attacks, causing widespread disruption.

Cloudflare Chief Executive Matthew Prince wrote on X that there had been thousands of attack attempts in the 10 hours before the patch was released, but the total reached millions afterward. Some security firms also came under criticism for releasing the patch earlier than the agreed time, giving hackers more time to analyze it.

South Korea More Exposed Because of Older Versions

Companies and governments around the world have moved to respond. The U.S. and U.K. governments urged businesses to install the security update and recommended taking systems offline if patching proves difficult. The Netherlands suspended services at the Port of Rotterdam, Europe’s largest port, as well as major political parties, hospitals and government portal sites to prepare for possible attacks. Japanese Prime Minister Sanae Takaichi called on operators to check whether their websites use PHP and apply the corrective patch as quickly as possible.

South Korea is classified as particularly vulnerable to possible PHP attacks. Versions below PHP 8.1, which are difficult to patch, account for 89% of usage in the country. That is higher than Japan’s 79%, the U.S.’s 71% and France’s 69%. Concerns are also rising that small and medium-sized businesses and small merchants may struggle to respond because many outsourced website builds are no longer covered by maintenance contracts. Moon Jong-hyun, head of the security center at Genians, said servers at smaller companies with limited cybersecurity staff could become weak points. Even after patches are applied, conflicts with other functions and other side effects may emerge. No damage cases have been reported in South Korea so far.

The South Korean government has also begun an emergency response. The Ministry of Science and ICT issued a Level 2 “caution” cyber alert for the private sector at noon on October 22 after a risk assessment meeting. It is the second of four alert levels: attention, caution, warning and serious. Under the measure, authorities will increase incident-response personnel and keep emergency response teams on standby. The National Security Office also held an emergency meeting chaired by Third Deputy Director Song Ki-ho with the Ministry of Science and ICT, the Ministry of National Defense and the National Intelligence Service to review response measures by sector.

▶PHP

Originally short for Personal Home Page, PHP is now used to refer to Hypertext Preprocessor. The programming language is widely used to build websites, online shopping malls, admin pages and other web services because it is relatively easy to use.

Park Han-shin and Ra Hyun-jin, Hankyung.com reporters phs@hankyung.com