Source: Hankyoreh

What happened

The Korean government raised the private-sector cyber threat alert to “Caution” (Level 2) and stood up a 24-hour emergency team after two critical PHP vulnerabilities, Hankyoreh reported on Oct. 23, 2026. The PHP Development Team had released a security update on Wednesday. The flaws, as the ministry and foreign media described them to the paper, let an attacker bypass authentication and run commands remotely by sending crafted requests — without a login.

Hankyoreh says the first of the bugs was found and reported in August by U.S. firm Calif, using OpenAI’s GPT-5.6 Sol, and scored 9.2 / 10 under CVSS 4.0 (Critical). Because the issue sits in the PHP runtime, the desk warns, a site can still be exposed even after the application looks “secured.”

MSIT and KISA messaged 5,900 C-TAS member firms and CISO-reporting businesses on Wednesday night to install updates. The National Security Office held an emergency meeting across public, private, and military sectors, chaired by deputy director Song Ki-ho. AhnLab TIP put about 112,183 Korean servers on vulnerable PHP versions — sixth globally after the U.S. (~550,000), China (240,000), Germany (190,000), Japan (150,000), and France (120,000).

The breakdown

Who is actually in the blast radius. PHP, launched in 1995 in Canada, still sits under a lot of WordPress — and Hankyoreh says WordPress is common in Korea for SME malls, company sites, and some public-institution and school homepages. The Ministry of the Interior and Safety played down central and local government impact, saying most of those systems use the e-Government Standard Framework on Java. That split matters: .go.kr Java is not the same as the unattended WordPress shop that still runs PHP 8.1 or lower, where official patches have stopped.

What the government asked for. Update PHP to the latest version. Upgrade anything on PHP 8.1 or lower. That is the whole public instruction. This brief will not describe payloads, request shapes, or reproduction steps.

Who the experts worry about. Korea University’s Kim Seung-joo told the paper SMEs often lack in-house security staff, so they cannot even triage a vulnerability mail, and that forgotten old sites sit open. He asked for practical government help, including remote inspections — a capacity gap, not a skill-issue lecture.

Overseas, Hankyoreh notes a White House statement on Wednesday about tracking and patching, and says Germany and France temporarily shut some government sites until patches landed. Use that as contrast, not as a claim that Seoul took the same step.

Why it matters outside Korea

If you run a Korea-facing shop, school page, church site, or expat bulletin on WordPress hosted in Korea (or on a Korean agency’s unmanaged VPS), you are in the 112,183 conversation until someone you pay says you are not. If you send customer data to a Korean SME vendor, the watch is whether they patched this week, not whether they have a SOC slide in the pitch deck.

If you build on PHP for a Korea client, 8.1 and below is now an explicit government “move off” line in this reporting. Budget the upgrade as operations, not as a nice-to-have refactor.

What travelers and expats should watch

• Do ask your Korean web vendor, today, what PHP version is in production and whether Wednesday’s update is installed. Get the version string in writing.
• Don’t keep an old marketing site “because it still loads.” Unmaintained WordPress is the failure mode the professors named.
• If you sell through a small Korean mall, pause new card-on-file campaigns until the vendor confirms the runtime patch — data-leak risk is the desk’s stated worst case, alongside defacement and downtime.
• Expect slower replies from KISA-adjacent queues while C-TAS mail is in circulation; that is a feature of a Level-2 private-sector alert, not a reason to ignore your own host.

Context

Read this as a runtime-patch drill aimed at SMEs and leftover WordPress, not as proof that “Korea’s government sites are wide open” and not as a how-to. Korelay’s frame: the Java e-government stack is the ministry’s comfort language; the 112,183 servers are the private leftover web. Your move is inventory and update, not curiosity about the bug.

Source

Primary: Hankyoreh English, Oct. 23, 2026 (Sun Dam-eun, Park Hyeon-jeong, Seo Young-ji). Alert level, server counts, and official advice as reported. This page does not include exploit detail.