[PHP Security Emergency] Cyber Crisis "Caution" Alert Issued... Cybersecurity Firms Step Up Response

A critical security vulnerability has been discovered in PHP, a programming language used on more than 70% of websites worldwide. The government has issued a cyber crisis “Caution” alert, while domestic cybersecurity firms have begun responding. They are urging users to update their software promptly through emergency notices and providing support to check for vulnerabilities and detect and block attacks.

Yonhap News Agency

According to the cybersecurity industry on October 23, AhnLab posted an urgent security advisory on its threat intelligence platform, AhnLab TIP. It is also conducting an in-depth analysis of the disclosed vulnerability and proof-of-concept code, and tracking attack code being distributed on platforms such as GitHub. AhnLab plans to assess the impact on its products with web capabilities and use the penetration-testing feature “Pentest AI” in AhnLab AI Plus to verify the possibility of attacks.

Stealien has released a free online service that lets users enter a website address to check whether it is affected by the PHP vulnerability. Genians has also issued a report titled “Urgent Notice on PHP Remote Code Execution Vulnerability,” recommending that users update their server’s PHP to the latest version. It also advised checking for signs of a breach, such as unauthorized files or unusual access, even after applying the patch, and isolating the server and changing any credentials that may have been exposed if suspicious activity is detected.

Everspin has applied a blocking rule to its web security solution for client companies to stop attacks exploiting this PHP security vulnerability. The company verified in its test environment that the attacks can be blocked at the gateway stage before reaching the PHP on clients’ servers.

Theori has also independently reproduced and verified the two vulnerabilities and released an emergency response guide. “PHP2Shell is a critical vulnerability that can put an entire server at risk, regardless of the application code,” said Im Juno, principal researcher on Theori’s AI & Cyber Research Team. “Until a patch is applied, users should immediately check their settings and determine whether their systems have been compromised by applying temporary mitigation measures and inspection scripts.”

On October 22, the Ministry of Science and ICT, following a crisis assessment meeting with the Korea Internet & Security Agency (KISA), issued a cyber crisis “Caution” alert and began monitoring attack trends. The ministry advised companies and institutions that use PHP to check the PHP versions on all websites and systems they operate and update them immediately to the latest version.

However, concerns have also been raised that many PHP servers in South Korea are vulnerable to security threats because they use older versions that are no longer supported. According to an analysis by U.S. cybersecurity company Mallory, 89% of PHP servers in South Korea use version 8.1 or earlier. This is higher than the global average of 73.5% and the rates in Japan (79%), the United States (71%), and Germany (57%).

This content was produced with the assistance of AI translation services.