PHP vulnerability puts South Korea's smaller websites on high alert as DC Inside, TheQoo scramble to respond

A critical security vulnerability discovered in PHP — a programming language used by websites worldwide — has raised growing fears of cyberattacks targeting small and medium-sized websites in South Korea.

DC Inside, South Korea's largest online community with about 3 million daily visitors, confirmed the PHP vulnerability and launched an emergency response. TheQoo, another major community platform estimated to draw about 1 million visitors a day, also carried out urgent security work.

Concerns are mounting that smaller websites still running systems built on PHP may be particularly exposed to hacking risks. Sites established during the 2000s and early 2010s — when PHP was widely adopted in South Korea — have been identified as the primary targets of concern.

Adding to the alarm, the share of South Korean websites using PHP is more than 10 percentage points higher than the global average, heightening anxiety across the country's IT industry.

Industry sources said Thursday the fallout from the PHP security vulnerability is expected to fall most heavily on domestic online communities and small and medium-sized websites built in the 2000s.

Smaller websites with limited development staff and security budgets are more likely to still be running aging PHP-based systems, leaving them exposed to the flaw.

PHP was the dominant programming language for building South Korean websites from the 2000s through the early 2010s. As newer languages such as Java and Node.js emerged, major IT companies gradually moved away from it. Online communities and smaller websites built on PHP during that era, however, continue to rely on it widely.

Emergency security responses have been under way at major domestic communities that have operated since the 2000s. DC Inside suspended its image and video upload functions at around 10:30 p.m. Wednesday. "We have blocked image and video uploads in order to apply a patch update after a PHP vulnerability was found," a DC Inside official said. The platform said its daily visitor count stands at about 3 million.

TheQoo also announced through a notice at around 10:46 p.m. Wednesday that it was conducting emergency server maintenance for security reasons. The community's daily visitor count is estimated at about 940,000.

By contrast, large domestic platform companies such as Naver and Kakao have been updating their development environments quickly, limiting the impact on them.

"PHP was a widely used programming language in the past, but major domestic platform companies switched their primary development language long ago," one industry official said. "Because the Korean market adapts quickly to digital changes, version updates also happen faster — so there is less concern here than in European markets, which tend to respond more slowly."

Domestic web hosting providers have also moved swiftly. Cafe24 applied emergency security settings to its PHP hosting servers. Gabia carried out an emergency security patch in the early hours of Thursday, notifying customers of possible service outages of about 30 minutes per server.

The fact that South Korean websites use PHP at a higher rate than the global average has deepened concerns. According to web technology analytics firm W3Techs, 82.7 percent of South Korean websites with an identifiable server-side programming language use PHP — 13.4 percentage points above the global average of 69.3 percent. Among websites using the ".kr" country-code domain, the PHP usage rate reached 75.1 percent.

The industry considers the vulnerability particularly dangerous because it allows hackers to execute malicious code on web servers without any login credentials.

Smaller websites that have run older versions of PHP for extended periods may struggle to apply security patches. Switching to the latest version risks causing errors in existing functions such as bulletin boards and membership management systems.

The government has also taken notice and begun preparing measures to help small and medium-sized enterprises respond to the threat. The Ministry of Science and ICT raised its cybersecurity alert for the private sector to the "Caution" level as of noon Thursday and activated an emergency response system. It is also reviewing plans to provide emergency security patch support for small and medium-sized enterprises that lack in-house security staff and technical capacity.

"We have already notified relevant companies about security measures, and we are reviewing options including emergency patch support for small and medium-sized enterprises," a Ministry of Science and ICT official said.