PHP developers announced a security update on October 22 fixing two vulnerabilities in the programming language that powers approximately 70% of websites worldwide, following discovery by U.S. security firm Calif using OpenAI's AI model GPT-5.6 Sol. The flaws, dubbed PHP2Shell, could allow attackers to remotely plant malicious code on servers. The South Korean government raised its cyber alert to Level 2 'caution' at noon on October 22 after a risk assessment meeting. The vulnerabilities were first identified in 2024 but considered too difficult to exploit until AI analysis confirmed the risk, prompting PHP developers to release the patch on October 21 after more than two months of verification following Calif's August report. PHP handles critical functions including payments and orders for financial firms, online malls and corporate websites, making the flaw a significant security concern for governments and businesses globally.
Calif Used GPT-5.6 Sol to Discover PHP2Shell Vulnerabilities
According to the PHP Foundation on October 22, Calif researchers used OpenAI's GPT-5.6 Sol model to identify two vulnerabilities in PHP and developed a security patch with PHP developers backed by OpenAI funding. The flaws were reported by Calif in August. Calif Chief Executive Thai Duong stated that the vulnerabilities had largely been forgotten because they were considered too difficult to exploit. PHP sits between websites and the servers behind them, handling functions such as payments and orders. If PHP contains security flaws, hackers may be able to break in, steal data from servers, alter websites at will, or use compromised systems to control other companies' servers.
PHP Developers Released Security Update on October 21
PHP developers announced the security update on October 21 fixing the PHP2Shell vulnerabilities after more than two months of verification work following Calif's August report. The possibility of the flaw was first raised in 2024, but at that time it was considered unlikely to be exploited and a fix was put on hold. Thai Duong added that hackers could use AI to reverse-engineer the patch and launch attacks, causing widespread disruption.
Millions of Attack Attempts Recorded After Patch Disclosure
Cloudflare Chief Executive Matthew Prince wrote on X that there had been thousands of attack attempts in the 10 hours before the patch was released, but the total reached millions afterward. Some security firms came under criticism for releasing the patch earlier than the agreed time, giving hackers more time to analyze it. The Wall Street Journal reported on the discovery and patching process.
South Korea Raised Cyber Alert to Level 2 Caution on October 22
The South Korean Ministry of Science and ICT issued a Level 2 'caution' cyber alert for the private sector at noon on October 22 after a risk assessment meeting. It is the second of four alert levels: attention, caution, warning and serious. Under the measure, authorities will increase incident-response personnel and keep emergency response teams on standby. The National Security Office held an emergency meeting chaired by Third Deputy Director Song Ki-ho with the Ministry of Science and ICT, the Ministry of National Defense and the National Intelligence Service to review response measures by sector. No damage cases have been reported in South Korea so far.
Older PHP Versions Account for 89% of South Korean Usage
Versions below PHP 8.1, which are difficult to patch, account for 89% of usage in South Korea according to available data. That is higher than Japan's 79%, the U.S.'s 71% and France's 69%. Moon Jong-hyun, head of the security center at Genians, said servers at smaller companies with limited cybersecurity staff could become weak points. Concerns are rising that small and medium-sized businesses and small merchants may struggle to respond because many outsourced website builds are no longer covered by maintenance contracts.
Global Governments and Companies Responded to PHP Vulnerability
The U.S. and U.K. governments urged businesses to install the security update and recommended taking systems offline if patching proves difficult. The Netherlands suspended services at the Port of Rotterdam, Europe's largest port, as well as major political parties, hospitals and government portal sites to prepare for possible attacks. Japanese Prime Minister Sanae Takaichi called on operators to check whether their websites use PHP and apply the corrective patch as quickly as possible.
FAQ
What vulnerabilities did OpenAI's AI model discover in PHP?
OpenAI's GPT-5.6 Sol model discovered two vulnerabilities in PHP dubbed PHP2Shell that could allow attackers to remotely plant malicious code on servers. U.S. security firm Calif used the AI model to identify the flaws and reported them in August, leading PHP developers to release a security update on October 21 after more than two months of verification.
Why is South Korea particularly vulnerable to PHP attacks?
South Korea is classified as particularly vulnerable because versions below PHP 8.1, which are difficult to patch, account for 89% of usage in the country. That is higher than Japan's 79%, the U.S.'s 71% and France's 69%. The South Korean government raised its cyber alert to Level 2 'caution' at noon on October 22 in response to the threat.
What actions did governments take after the PHP vulnerability disclosure?
The U.S. and U.K. governments urged businesses to install the security update and recommended taking systems offline if patching proves difficult. The Netherlands suspended services at the Port of Rotterdam, major political parties, hospitals and government portal sites. Japanese Prime Minister Sanae Takaichi called on operators to apply the corrective patch quickly. South Korea's Ministry of Science and ICT issued a Level 2 cyber alert on October 22.
