A serious PHP vulnerability has put about 112,000 domestic servers at risk, with attackers potentially able to take control without authentication. A crafted request can exhaust memory and trigger errors that cause released memory to be reused or false data to be accepted as valid, creating a path to command execution, data theft, or malware installation.
The risk increased after a security patch was released roughly six hours ahead of schedule, allowing attackers to compare the fixed and vulnerable versions. South Korea raised its cyber crisis alert to caution, while operators were urged to update PHP, restart server programs, and restrict external access if immediate patching is not possible.