South Korea issues PHP security FAQ after three RCE flaws disclosed
The science ministry and KISA urged PHP site operators to update to fixed versions and check logs and file changes since October 20.
South Korea's Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) published a "PHP2Shell" security FAQ on October 26, 2026, urging operators of PHP-based websites to update their systems and check for signs of compromise, according to digitaltoday.co.kr.
The advisory follows the confirmation of three PHP remote code execution vulnerabilities that allow attackers to run malicious commands on servers without logging in.
Two of the flaws, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, and the ministry recommended immediate updates at the time. A third, CVE-2026-115560, was disclosed on October 24, 2026. Until a patch is released, the ministry says it requires a separate configuration with "session.upload_progress.enabled=0" and a restart of the PHP process.
KISA lists PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later as safe.
What operators should check
Operators are advised to review server access logs and file changes since October 20, 2026, and to replace database passwords, administrator account passwords and external service integration keys. Servers suspected of compromise should not be shut down immediately, so that memory evidence is preserved.
Incidents can be reported by calling 118 or through KISA's Bohonara service. PHP 8.2 security support is scheduled to end on December 31, 2026, and PHP 8.1 and earlier versions are already unsupported.
Quick answers
Which PHP versions are safe from the PHP2Shell flaws?
KISA lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later as safe versions.
How do I report a suspected PHP server compromise in South Korea?
Call 118 or use KISA's Bohonara service. The authorities advise not shutting down a suspected server immediately, to preserve memory evidence.
When were the PHP vulnerabilities disclosed?
CVE-2026-109618 and CVE-2026-109619 were disclosed on October 21, 2026, and CVE-2026-115560 on October 24, 2026.