The government has initiated an emergency response following the discovery of a critical security vulnerability in PHP, a programming language widely used across websites worldwide, that could allow attackers to take control of systems without authentication.

The Ministry of Science and ICT (MSIT) and the Korea Internet & Security Agency (KISA) requested relevant companies to implement security measures regarding the PHP vulnerability on the night of October 21.

The targets are member companies of the Cyber Threat Information Analysis and Sharing System (C-TAS) and companies obligated to appoint a Chief Information Security Officer (CISO).

C-TAS is a cyber threat information analysis and sharing system operated by KISA, through which approximately 5,900 companies and institutions share cyber threat information.

Under the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc., the number of companies obligated to designate and report a CISO to the MSIT currently stands at approximately 30,000.

The government also posted a notice recommending PHP security updates and patch applications on "KISA Bohonnara," a cyber threat information guidance portal.

This vulnerability is known to carry the risk of allowing attackers to execute arbitrary code externally or take control of systems without separate login or authentication procedures if exploited.

PHP developers urgently released a new version fixing two of these vulnerabilities on October 21 local time.

The cybersecurity industry points out that small and medium-sized enterprises (SMEs) lacking dedicated security personnel and response capabilities may find it difficult to quickly apply patches following the discovery of the vulnerability.

Consequently, voices are being raised calling for the government to prepare practical countermeasures, such as supporting emergency patches.

An official from the MSIT stated, "We first notified relevant companies of the security measures, and we are reviewing support for emergency patches for SMEs."

Web technology analysis firm W3Techs estimates that approximately 75% of websites that identify their programming language use PHP.

WordPress, which is used by approximately 43% of all websites, also operates based on PHP.

This vulnerability was reportedly discovered by cybersecurity firm Califf using OpenAI's artificial intelligence (AI) model "GPT-5.6 Sol."