Artificial intelligence has uncovered critical security flaws in software powering much of the internet, triggering emergency responses worldwide. In South Korea, the discovery has raised fresh concerns just weeks after hackers used AI tools to breach several major financial institutions and steal customer information.
The latest threat highlights how AI is changing cybersecurity on both sides of the battle. Researchers used advanced AI models to expose vulnerabilities that had remained in PHP for years, revealing ways attackers could take control of web servers without passwords. The same technology that helps security experts uncover hidden weaknesses can also make sophisticated cyberattacks easier to develop.
The implications extend far beyond South Korea. PHP powers widely used website platforms such as WordPress and supports essential functions including customer logins, online purchases and content management. A successful attack could expose sensitive information or compromise the servers behind websites used by businesses and consumers around the world.
The vulnerabilities, collectively known as PHP2Shell, were identified through research involving cybersecurity firms Calif and Wiz, with assistance from AI models developed by OpenAI and Google. Wiz said advanced AI helped researchers turn longstanding software defects into working attacks that previously would have required extensive technical expertise.
PHP developers released emergency security updates on October 21 after researchers demonstrated that attackers could exploit the vulnerabilities without obtaining login credentials. The flaws received critical severity ratings of 9.2 out of 10.
The discovery comes at a particularly sensitive time for South Korea, which has recently experienced a series of cyberattacks involving AI.
Between late September and early October, several South Korean financial institutions, including Shinhan Bank, KB Kookmin Bank and Hana Bank, suffered security breaches. CrowdStrike, a U.S. cybersecurity company, identified evidence that attackers used an AI powered penetration testing tool called ARTEX alongside large language models to carry out the attacks.
The incidents exposed customer information and prompted investigations by South Korean financial authorities. Although the financial sector attacks were unrelated to PHP2Shell, they demonstrated that hackers were already using AI to carry out intrusions against Korean organizations.
The new PHP vulnerabilities have therefore emerged against a backdrop of heightened concern over AI enabled cybercrime.
South Korea’s government raised its national cybersecurity warning level to caution on October 22 and urged businesses and public agencies to install security updates. Technology companies and cybersecurity providers also began emergency inspections and protective measures.
AhnLab, a South Korean cybersecurity company, identified approximately 110,000 domestic internet hosts running PHP through an internet asset search service. The company subsequently clarified that the figure did not represent a verified count of vulnerable servers, leaving the actual scale of exposure uncertain.
AhnLab also warned that smaller websites operating for years without regular updates could face particular risks. Attempts to exploit the PHP vulnerabilities had been observed before official security patches became available.
South Korean hosting companies have moved to protect websites operating on their infrastructure.
Cafe24, a South Korean ecommerce platform and web hosting provider, applied emergency PHP security patches and notified customers of the necessary precautions.
Gabia, another South Korean web hosting company, began security updates early on October 22 and completed protective measures across affected PHP versions. Older software versions that no longer receive official support required separately adapted patches or temporary safeguards.
Naver Cloud, the cloud computing business of South Korean internet company Naver, was applying a third round of security patches while advising customers to update their systems.
Other providers have also reviewed their exposure. NHN Cloud, a South Korean cloud infrastructure company, said its internal systems did not use PHP but was conducting comprehensive checks to identify potential indirect effects. KT Cloud, the cloud services business of South Korean telecommunications company KT, reported no confirmed breaches linked to the vulnerabilities and said it would continue monitoring the situation.
Cybersecurity companies have introduced additional defenses.
EverSpin, a South Korean web security provider, deployed new blocking rules designed to stop malicious requests before they reached vulnerable PHP servers. Stealien, another domestic cybersecurity company, launched a free website scanning service to help operators identify potential exposure.
Theori, a South Korean cybersecurity research company, independently reproduced the vulnerabilities and published emergency response guidance, urging administrators to apply temporary protections and examine their systems for signs of compromise.
No confirmed breaches or suspected damage directly related to PHP2Shell had been reported by South Korea’s technology and cybersecurity industry as of October 22. The absence of confirmed incidents, however, does not establish that vulnerable systems are safe.
The latest developments illustrate a growing challenge for cybersecurity. AI is helping researchers discover and fix weaknesses that have persisted for years, but it can also reduce the expertise and time needed to develop attacks against those same weaknesses.
South Korea’s recent experience with AI assisted financial hacking has already demonstrated the offensive side of that shift. The PHP2Shell discovery now shows the defensive side, while forcing companies to race to secure their systems before attackers can exploit the flaws.
The immediate challenge is no longer simply finding dangerous vulnerabilities. It is ensuring that the websites and services built on vulnerable software are protected before those discoveries become another wave of cyberattacks.
