Fears grow that SMEs are in a ‘blind spot’ amid PHP hacking concerns... ‘On-site technical support is urgent’

[Financial News] A critical security vulnerability has been discovered in PHP, a programming language widely used on websites around the world, raising concerns that companies may struggle even to determine whether their own systems are affected. PHP is used throughout websites, and small and midsize businesses and schools with limited in-house security capabilities may also have difficulty checking for vulnerabilities.

Experts stress that on-site support to identify vulnerabilities and apply updates is urgently needed before the status of security measures can be assessed.
According to security industry sources on the 22nd, PHP is a server-side programming language used to build a range of website functions, including logins, message boards and order processing.

When a user requests an operation on a website, PHP runs the relevant program on the server and provides the result. It is used for tasks such as checking order histories on online shopping sites, posting on message boards and connecting to databases.
PHP is widely used across websites and is not limited to any particular service. According to W3Techs, a web technology analytics company, about 75% of websites worldwide for which the server-side programming language can be identified use PHP. WordPress, a content management system (CMS) used by about 43% of all websites, also runs on PHP. Its uses range from personal blogs and corporate websites to online shopping sites.

On the 21st, the Korea Internet & Security Agency (KISA) said that two vulnerabilities had been identified in PHP—“improper exception handling” (CVE-2026-109618) and “use after free” (CVE-2026-109619)—and recommended security updates. The affected versions are earlier than PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, respectively. Those versions should be updated to releases with the security patches applied, while PHP 8.1 and earlier, which are no longer receiving official security support, should be replaced with a supported version.
Concerns have been raised that it could take companies a considerable amount of time to determine which of their systems use PHP and whether those systems are running vulnerable versions. Small and midsize businesses and schools that outsource website development and operation or lack in-house security staff may have difficulty understanding the technical details of the vulnerabilities and responding to them. This is why calls are growing for support that goes beyond simply recommending security updates and helps verify whether they have actually been applied.

Experts therefore recommend prioritizing technical support for organizations on the ground that lack the capacity to respond, rather than immediately compiling inspection results from individual companies.
Kim Seung-joo, a professor at Korea University’s Graduate School of Information Security, said on social media (SNS), “I hope companies can be asked a little later for statistical reports on how many systems they inspected and addressed in connection with the PHP vulnerability incident.”
He added, “I think it would be appreciated if you could focus on helping small and midsize businesses and schools that may not even understand what the vulnerability report means or know whether they are affected. I think it would be best to prioritize on-site support to help them determine whether they are affected by the vulnerabilities and take the necessary measures.”
[email protected] Choi Hye-rim Reporter