A critical security vulnerability has been discovered in PHP, a programming language widely used for web services, requiring immediate security patching. A successful exploit could allow attackers to immediately take full control of the system or steal stored data. We strongly urge all campus members to review the following information and actively cooperate to proactively prevent security incidents.


   1. Applicable Systems (Target Scope)

      o Websites and web services built using PHP (e.g., sites built using website building tools or CMS platforms such as WordPress)

      ※ Includes devices or equipment utilizing web-based management consoles/interfaces


   2. ulnerability Overview and Threat Details

     o The identified vulnerabilities have been assigned a CVSS score of 9.2 (Critical), posing severe security risks.

     o These Remote Code Execution (RCE) vulnerabilities allow unauthenticated remote attackers to execute arbitrary code or gain administrative

        control over the target server.


     ■ CVE-2026-109618 (Improper Handling of Exceptional Conditions)

     o Description: A flaw where the PHP engine fails to safely handle unexpected errors or exceptional input conditions.

     o Threat: Attackers can exploit this improper exception handling to manipulate the server's internal execution flow and execute arbitrary malicious

                  commands.


     ■ CVE-2026-109619 (Use After Free)

     o Description: A memory management flaw where the PHP engine accesses memory locations after they have already been freed.

     o Threat: Attackers can overwrite the freed memory area with malicious payloads, leading to full remote compromise of the server.


   3. Affected Versions and Remediation Criteria

     [Supported Versions - Immediate Patch Required]

       o PHP 8.2: Versions prior to 8.2.35 -> Update to 8.2.35 or higher

       o PHP 8.3: Versions prior to 8.3.36 -> Update to 8.3.36 or higher

       o PHP 8.4: Versions prior to 8.4.27 -> Update to 8.4.27 or higher

       o PHP 8.5: Versions prior to 8.5.12 -> Update to 8.5.12 or higher


   [End-of-Life (EOL) Versions - Version Upgrade Mandatory]

       o PHP 8.1 and earlier (including all PHP 5.x and 7.x versions) :

          Official security support for these versions has ended, and no security patches will be released.

          You must upgrade to an actively supported version (PHP 8.2 or higher).

      ※ Special Notice for Campus System Administrators:

           Many websites across academic departments and research labs (e.g., outdated Gnuboard, XpressEngine/XE, WordPress) built via external

           vendors are still running on unmaintained PHP 5.x or 7.x environments.

           Since EOL versions cannot be patched against these zero-day threats, you must migrate to a supported version immediately.

           If immediate upgrading is not feasible, you must restrict off-campus external access via firewall rules

           (e.g., allowing campus network or campus VPN access only).


   4. How to Verify Your Installed PHP Version

      [Method 1] Via Server Terminal / CLI (Recommended)

      o Check current PHP version: php -v

      o Check detailed package versions via OS package manager:

         Ubuntu / Debian: dpkg -l | grep php

         CentOS / RHEL / Rocky Linux: rpm -qa | grep php


      [Method 2] Via CMS Administrator Dashboard

      o Gnuboard: Admin Page > [Environment / Settings] > [Basic Configuration] or [System Info]

      o WordPress: Admin Dashboard > [Tools] > [Site Health] > [Info] Tab > [Server]


      [Method 3] Via Temporary Web Script (phpinfo)

      o Create a temporary file (e.g., check.php) in your web root directory and open it in a browser:

      ※ Warning: The phpinfo script exposes sensitive server environment configurations and file paths.

                         Make sure to delete the file immediately after checking the version.


   5.Required Actions for System Administrators

      o Apply Security Patches:

         Update PHP to the patched version or higher via your operating system package manager (apt, dnf, yum, etc.) or source recompilation.

      o Inspect Inactive / Unmaintained Servers: Audit research project servers, temporary event websites, and management consoles.

         Shut down any unnecessary or unattended services exposed to external networks.

      o Temporary Mitigation: If immediate patching is not possible due to legacy code compatibility, block public external access at the firewall

         and restrict access strictly to on-campus IP ranges or campus VPN.


   6. Contact and References

     o Contact: Information Security Officers, Information Infrastructure Team(02-3290-4191, 4196, 4198 / security@korea.ac.kr)

     o Official Advisory: PHP Official Security Announcement ( https://www.php.net/archive/2026.php#2026-10-21-5 )