Two critical security vulnerabilities have been discovered in PHP, a programming language widely used across global websites, prompting the government to initiate an emergency response. The National Security Office is assessing the public and private sector's readiness, while the Ministry of Science and ICT has raised the cyber crisis alert level from 'attention' to 'caution' for the private sector.
On October 22, the National Security Office held an emergency cybersecurity meeting led by Deputy Director Song Gi-ho. Officials from the Ministry of Science and ICT, the Ministry of National Defense, and the National Intelligence Service participated to review the current use of PHP and security measures across sectors. Attendees agreed to share real-time updates on their responses.
Deputy Director Song stated, "These vulnerabilities allow attackers to take control of servers without authentication, and attempts have already been reported overseas. The speed of our response will determine the extent of the damage. I urge the public and private sectors to work as a unified team to implement swift measures."
PHP is commonly used for creating websites, online shopping platforms, and forums. Popular domestic platforms like WordPress and Gnuboard also operate on PHP.
The vulnerabilities enable attackers to execute malicious commands on servers without needing to log in or authenticate, raising concerns about potential data breaches and website tampering or outages.
Security experts warn that the PHP vulnerabilities could lead to breaches of internal systems beyond just website tampering. Given PHP's widespread use in web service development, vulnerable systems exposed to the internet and connected to internal servers or databases could result in significant damage.
In response, the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) elevated the cyber crisis alert level to 'caution' for the private sector starting at noon on the same day. They activated an emergency response system, increasing the number of incident response personnel and placing emergency teams on standby.
The Ministry urged businesses and organizations to verify their use of PHP and its versions, applying security updates immediately. After updating, they should restart their web services and transition to supported higher versions if they are using PHP 8.1 or lower, which no longer receives official updates. If immediate action is not feasible, they were advised to consider blocking external access or temporarily suspending services.
The Personal Information Protection Commission also recommended limiting direct internet access to database management tools and minimizing database access permissions for web service accounts to prevent data breaches. Organizations should check for abnormal access patterns, such as mass data queries or exports, and verify the use of PHP by outsourced or contracted systems.
Furthermore, the government requested that even updated servers be checked for unusual access or signs of intrusion, such as the installation of web shells, and to report any suspected breaches to KISA immediately.
Experts suggest that as AI's vulnerability detection capabilities improve, security responses must also accelerate. Kim Myung-joo, a professor at Seoul Women's University and director of the AI Safety Research Institute, noted, "PHP is commonly used across numerous websites, so a single vulnerability can lead to widespread damage. Attackers can also leverage AI, making it crucial to expedite the development of security patches and their application to websites."
He added, "This incident is not the end but the beginning. We must prepare for AI to uncover vulnerabilities that have not previously been detected."
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.