PIPC: "PHP Security Vulnerability Exposed... Could Directly Lead to Personal Information Leaks"

"Concern Over the Exposure of Users' Personal Information Stored in DBs"
Strengthen Security Updates and Management Systems

The Personal Information Protection Commission (PIPC) urged companies and institutions on October 22 to take protective measures to prevent personal information leaks related to a recently disclosed PHP security vulnerability. The vulnerability is so severe that it could directly lead to the exposure of personal information.

"PHP2Shell," announced on October 21, is a vulnerability that allows attackers to execute arbitrary malicious commands on a web server without a separate login or authentication process. The Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) have provided guidance on measures to address the vulnerability.

EPA-Yonhap News

PHP is open-source software widely used to develop and operate web services. If this vulnerability is exploited, it could lead not only to a web server breach but also to the exposure of users' personal information stored in connected databases (DBs). The vulnerability allows hackers to access a server and execute arbitrary commands without a separate login or authentication process. Under the Common Vulnerability Scoring System (CVSS), the flaw received a score of 9.2 out of 10 and was classified in the highest, "Critical," severity category.

The PIPC urged companies and institutions to check the versions of PHP-based systems they use and apply the latest security patches, as well as remove unnecessary web services. It also advised them to restrict direct internet access to DB management tools, check and update their versions of phpMyAdmin software, and minimize the access permissions that web service accounts have to personal information databases.

To prevent large-scale leaks of personal information, organizations should check for unauthorized access to personal information databases, detect and block unusual activity, and strengthen access log management. They should also check whether outsourced developers or contractors are using PHP software and take appropriate action.

Yang Cheongsam, Secretary General of the PIPC, said, "This vulnerability could lead to large-scale damage, including the exposure of the personal information of numerous users stored in connected databases, rather than being limited to a breach of the website itself. Companies and institutions must exercise special care to prevent the public's personal information from being exposed by strengthening their management systems, including security updates and checks for suspicious access."

This content was produced with the assistance of AI translation services.