Global websites powered by PHP—the backbone of a significant share of the internet—are facing heightened security risks following the disclosure of two severe vulnerabilities. While emergency patches have been rolled out, cybersecurity experts warn that a vast landscape of legacy servers remains exposed, leaving numerous organizations vulnerable to cyberattacks.

Critical Vulnerabilities and Massive Exposure

According to industry sources on the 22nd, PHP is a widely used server-side scripting language that processes user requests such as logins and product orders. It powers a massive portion of the global web ecosystem, utilized by approximately 69% of websites whose underlying programming languages have been identified.

The newly discovered security flaws allow attackers to execute malicious commands directly on servers without needing valid credentials, such as usernames or passwords. This creates severe risks, including website defacement, service disruptions, and the theft of sensitive user data and access credentials. The official PHP development team rated both vulnerabilities at 9.2 out of 10, categorizing them as "critical," and immediately issued emergency security patches while urging prompt updates.

Major domestic hosting and cloud service providers have rushed to respond. Cafe24 applied official security patches to PHP versions 8.2 and above while executing separate security measures for discontinued versions like 7.4 and 8.1. Gabia also implemented emergency patches across versions 7.4, 8.4, and 8.5.

The Legacy Server Dilemma and Security Blind Spots

The primary concern lies in the slow response rate of individual website operators. According to initial findings by internet monitoring firm Censys on the 21st, out of roughly 1.57 million PHP servers with identifiable versions, about 1.15 million (73%) were running versions 8.1 or lower—versions that have already reached the end of their official support lifecycle. Because official updates are no longer provided for these legacy versions, hosting providers or individual server administrators must manually apply patches or migrate to newer versions. Security firm AhnLab estimated that South Korea alone hosts approximately 110,000 servers running vulnerable PHP versions, ranking it sixth globally in exposure.

Older websites often delay upgrades because transitioning to a newer PHP version can break legacy code and disrupt existing functionalities. In particular, small and medium-sized enterprises (SMEs), public institutions, hospitals, and schools—many of which lack dedicated IT security personnel—tend to operate outdated systems that could remain prime targets for extended periods. While strengthening web application firewalls (WAF) is frequently discussed as a mitigating step, experts note that firewalls alone cannot completely neutralize the vulnerability, serving only as a temporary fix.

AI-Accelerated Exploit Codes and Urgent Recommendations

Compounding the threat is the rapid proliferation of exploit codes. A report released by AhnLab revealed that out of the top 100 repositories analyzed on GitHub, 99 were related to the latest vulnerability, with the vast majority created within a single day. Among them, 36 repositories contained functional proof-of-concept (PoC) codes intended to test actual hacking capabilities. Experts warn that the integration of artificial intelligence (AI) has significantly lowered the time and cost required to convert vulnerability disclosures into active exploit scripts, heightening the risk of automated attacks targeting unpatched servers.

AhnLab emphasized in its report, "The fundamental solution is to update PHP to a patched version. Furthermore, servers that were exposed to the internet prior to patch application must undergo thorough forensic checks to determine whether a breach has already occurred." As threat actors race to weaponize these flaws, global web administrators face an urgent race against time to secure their infrastructure.

[Copyright (c) Global Economic Times. All Rights Reserved.]