Government Issues Cyber Crisis "Caution" Alert Over PHP Security Flaw... Security Firms Respond

Private-Sector Alert Issued Effective Noon on October 22
Companies and Institutions Urged to Apply Emergency Patches and Check for Signs of Compromise

Amid the discovery of a critical security vulnerability in PHP, a programming language used by more than 70% of websites worldwide, the government has issued a cyber crisis “Caution” alert and urged domestic companies and institutions operating PHP-based websites to apply security updates immediately.

A screen on a device in Berlin, Germany, on the 21st (local time), displays a French government website that is inaccessible. Berlin, Germany=Reuters-Yonhap News.

The Ministry of Science and ICT said it had issued a “Caution” alert for the private sector effective noon on October 22, following a crisis assessment meeting with the Korea Internet & Security Agency (KISA). The alert is intended to raise awareness of the possibility of large-scale hacking attacks exploiting the PHP vulnerability and to enable a proactive response. Website development tools widely used in South Korea, including WordPress and Gnuboard, run on PHP.

The vulnerability discovered this time poses a high risk. An attacker can send a specially crafted request over the internet without an ID or password and execute commands of their choice on a server. A successful attack could lead to serious damage, such as hackers secretly installing remote-control files on a server, leaking customer information, or defacing or disabling a website.

In particular, this is a security vulnerability in PHP itself, not in individual website programs, so websites may be affected even if their programs have been made secure.

The Ministry of Science and ICT has urgently distributed its recommendations to companies that have reported a chief information security officer (CISO), major information and communications infrastructure facilities, companies certified under the Information Security Management System (ISMS), web hosting providers, internet data centers, and members of cyber threat information-sharing groups. It is also working with domestic and international security companies to continuously monitor attack trends. On the same day, KISA posted a security update advisory on its Boho Nara website.

The ministry advised companies and institutions using PHP to check the PHP versions on all websites and systems they operate and update them to the latest version immediately. Official updates are no longer available for PHP 8.1 and earlier versions, so users should upgrade to a newer version. They should also check whether PHP is used on websites created long ago and left unmanaged, online stores built by outside contractors, and equipment management interfaces.

Even after updating, organizations should check for signs of intrusion, such as unusual access records or the installation of remote-control files, and report suspected incidents to KISA. Small businesses and others that operate websites through hosting providers should check with their providers whether security updates have been applied.

In addition, files circulated online as proof-of-concept (PoC) attack code may contain hidden malicious code, so users should not download or run code from unclear sources.

Bae Kyunghoon, Deputy Prime Minister and Minister of Science and ICT, said, "From a corporate perspective, the usual vulnerability management cycle under which systems are manually checked and patched within a few days is not enough to defend against attacks. Automated response systems are essential, including immediately blocking internet-facing assets and proactively applying web application firewall (WAF) rulesets." He added, "This is a grave situation that requires all government ministries to respond as one team. We plan to work with each ministry to discuss security checks and requests for remedial action targeting small and medium-sized enterprises."

Security Industry: "Fixing Website Code Won't Stop It... PHP Must Be Updated Immediately"

Images related to PHP web design.

Domestic cybersecurity companies are taking urgent action, including informing clients of response measures. Genians issued an "Urgent Advisory Report on the PHP Remote Code Execution Vulnerability," recommending that servers be updated to the latest version of PHP. It also advised checking for signs of intrusion, such as unauthorized files or unusual access, even after applying the patch, and isolating the server and replacing credentials that may have been exposed if any suspicious activity is detected.

Everspin said it had applied blocking rules to its web security solution for clients to stop attacks targeting this vulnerability. The company said it verified in its own test environment that attack requests are blocked at the gateway before reaching clients' PHP servers.

Theori also independently reproduced and verified the two vulnerabilities and released an urgent response guide. Lim Juno, a senior researcher on Theori's AI & Cyber Research Team, said, "PHP2Shell is a critical-severity vulnerability that can put an entire server at risk, regardless of the application code." He urged users to "apply temporary mitigations and inspection scripts before a patch is available to immediately check configurations and determine whether systems have been compromised."

Experts said the incident shows that AI is beginning to turn software flaws that have existed for a long time but were difficult to exploit into practical attack tools. Nishan Mills, an AI and analytics researcher at Australia's La Trobe University, said, "Software security has been protected by the implicit assumption that, even if deep-seated flaws are found, they would be too difficult to exploit in practice. AI is tearing down that protective barrier."

Lee Gihyeong, a professor at Chung-Ang University's Graduate School of Security, said, "In South Korea, outdated PHP versions that are no longer supported are often left in place on outsourced websites whose maintenance contracts have ended, as well as on local government and school websites." He recommended shortening the patch response cycle to a matter of days, noting that "AI has turned complex bugs once considered 'virtually impossible to exploit' into real weapons."

This content was produced with the assistance of AI translation services.