The Korea Internet & Security Agency (KISA) announced yesterday (October 21) that vulnerabilities have been discovered in PHP, a programming language widely used for website development, and recommended security updates.

According to KISA, the identified vulnerabilities consist of two cases: an Improper Handling of Exceptional Conditions vulnerability (CVE-2026-109618), which fails to properly handle exceptional situations, and a Use After Free vulnerability (CVE-2026-109619), which references memory that has already been freed.

The affected versions include four PHP versions: 8.2, 8.3, 8.4, and 8.5.

Users are exposed to vulnerabilities if they are using versions below 8.2.35, 8.3.36, 8.4.27, and 8.5.12, respectively.

KISA has recommended updating to these respective versions or higher.

In particular, KISA emphasized that because PHP versions 8.1 and below have already reached the end of their official security support, users must upgrade to currently supported versions.

Meanwhile, the PHP security flaw is reportedly capable of allowing external parties to execute arbitrary code or take control of systems without requiring separate login or authentication procedures.

According to foreign media outlets such as The Wall Street Journal (WSJ) and Reuters, citing web technology analytics firm W3Techs, approximately 75% of websites with identifiable programming languages use PHP, and about 43% of all websites run on WordPress, which is also based on PHP.

Government agencies in some European countries, including the Netherlands and Finland, have suspended website operations as a precautionary measure, and cybersecurity authorities in Europe, Japan, and Australia have also issued urgent update advisories.

(Photo: Getty Images)