No username needed. No password needed. A single crafted request lets a hacker run any command they want on your server. The exploit code is already public on the internet, and attack attempts are still coming in right now.
It’s been - days since the first attack was spotted (Oct 17).
Has your site really been safe all this time?
Operated by Global Vision Co., Ltd. (AI Division)
Attacks are being launched in bulk across the entire internet, indiscriminately (millions of exploit attempts, press reports). In Korea alone, an estimated 110,000 servers run a vulnerable PHP version (AhnLab survey, pre-patch estimate). Government emergency advisories go mainly to companies that have registered a Chief Information Security Officer (CISO), so small businesses have to look after themselves.
Under Korea’s Personal Information Protection Act, once you learn of a personal data leak you must notify customers within 72 hours — and if it was caused by hacking, report it to the Personal Information Protection Commission or KISA.
Failing to report a leak makes you liable for an administrative fine.
If data leaks because you didn’t take adequate safeguards, you can be hit with a penalty surcharge of up to 3% of your total revenue.
Basis: Korea’s Personal Information Protection Act, Articles 34, 64-2 and 75, and its Enforcement Decree, Articles 39 and 40 (Easy-to-Find Korean Law (easylaw.go.kr), Personal Information Protection Commission)
The government advises that even servers that have been updated should be checked separately for abnormal access records and installed web shells. A hacker who got in before the patch is not kicked out by the patch.
The flaw is in the PHP engine itself, so even a well-built website offers no protection. Public exploit code and attack attempts have already been reported.
A single crafted request runs arbitrary commands on your server — leading to web shell installation, customer data leaks, website defacement and intrusion into your internal network.
Virtually every PHP release since 2012. GNUBoard, YoungCart, WordPress, Rhymix and custom-built sites are all affected.
Attack attempts using the public exploit code are ongoing. Updating alone isn’t enough — the fix only takes effect once the web server (PHP-FPM · Apache) is restarted.
8.5.128.4.278.3.368.2.35
or later + web server restart
PHP 8.1 and earlier have no official patch. PHP 8.2 also reaches end of support at the end of 2026, so we recommend migrating to 8.3 or later. If you don’t restart the web server after updating, the old version keeps running.
Every site built on PHP is affected. Most Korean websites and online stores run on PHP — and using shared web hosting doesn’t make you safe.
Just enter your website address. We actually visit the site to check whether it uses PHP, which version is exposed and what security protections are in place, then show you a risk rating. No attacks or intrusion — we read only the home page, exactly like a normal visitor.
Try it with naver.com, coupang.com or wordpress.org.
The right measures depend on your server environment and whether you’ve already been compromised. After a diagnosis, we quote only what you actually need.
We place a Cloudflare security proxy in front of your site to filter attack requests before they reach your server. No changes to the server itself, so it’s the fastest option.
We upgrade PHP to a fixed version, apply mitigation settings, then restart the web server and verify the version actually running.
We check whether attackers already got in during the pre-patch exposure window, analyzing logs and files to find and remove web shells.
We move unpatched PHP 5, 7 and 8.1 to 8.3 or later. Compromised servers aren’t repaired — they’re rebuilt clean on a new server.
| Your situation | Recommended action |
|---|---|
| Shared web hosting, still on a legacy version | AD Shield, then version migration |
| Self-managed server, PHP 8.2 or later | AB Shield + patching & configuration |
| Self-managed server, exposed since before Oct 20 | ABC + compromise inspection |
| PHP 8.1 or earlier, or suspected hack | ACD Inspection, then clean rebuild |
After a free diagnosis, we give you an exact quote first and start only once the scope and price are confirmed. No additional charges are ever incurred without your consent.
We price in stages based on site size and server condition.
Fill out the form below. Do not include server passwords.
We will contact you within 1 hour. We review your situation and run a free diagnosis.
We explain the scope and price, then confirm.
Bank transfer or card payment.
Access details are shared via a separate secure channel, and we start immediately.
Results report delivered, plus a 30-day re-inspection.
Global Vision Co., Ltd. (AI Division) handles the diagnosis and the work directly.
We preserve the pre-change state and roll back immediately if anything goes wrong.
No one can guarantee ‘100% hack-proof’. Our report tells you exactly what we did and what risks remain.
Log and source code analysis runs on our own equipment. When the work is done, we destroy the materials and access details we received.
Yes. Your hosting provider manages only the server’s PHP. PHP 8.1 and earlier get no official update, and malicious files planted before patching aren’t removed by the patch. We also take care of checking your site files and admin accounts, and fixing anything that breaks when the version is upgraded.
No. The flaw is in the server’s PHP engine. Even if you update your website software, you remain vulnerable as long as the server’s PHP is unchanged.
If a web shell was planted during the pre-patch exposure window, hackers can keep coming and going even after you patch. If your server was online before Oct 20, we recommend a compromise inspection and rotating passwords and keys.
The shield (A) causes almost no downtime. Server patching needs a restart that takes a few seconds to a few minutes. We can schedule it outside your business hours.
Once the quote is confirmed, we receive them through a separate secure channel your contact person will provide. Never put passwords in the inquiry form, text messages or messengers. After the work, we’ll advise you to change your passwords.
Yes. Provide your business details at payment and we’ll issue one.
If you don’t check today, the next thing you see may be angry calls from customers — and a data breach report to file.
If you’re unsure about any field, just leave it as ‘Not sure’ — we’ll work it out with you. Business hours: Daily 09:00–22:00 (KST) · +82 10-6617-9702