[PHP Security Emergency] "Vulnerable SMEs Prime Targets for Attacks... Identifying and Managing Assets Is Urgent Priority"

Rapid security updates are the top priority
Extra caution needed when relying on outside firms
Consider national-level support measures for SMEs

"An estimated 110,000 servers in South Korea appear to be running versions of PHP vulnerable to hacking, but the actual number is likely much higher. If attacks are launched simultaneously, they could cause widespread chaos." (Moon Jonghyun, director of the Genians Security Center)

As concerns about hacking damage spread worldwide following the disclosure of a security vulnerability in PHP, a key programming language used on the internet, and the detection of attacks targeting the flaw even before a security patch was released, South Korean security experts identified "rapid security updates" as the top priority. Small and medium-sized enterprises (SMEs), which generally have weaker information security infrastructure, including fewer security personnel and smaller budgets, could become prime targets for hackers if their security updates are delayed.

In a phone interview with The Asia Business Daily on October 23, Moon Jonghyun, director of the Genians Security Center, said, "SMEs rarely have staff dedicated solely to managing their web servers or websites. They may have employees who also manage other infrastructure, while smaller companies often outsource everything from website development to setup. Requests are now pouring in to outsourcing firms because of this PHP vulnerability, so responding may not be easy." He said companies that rely on outsourcing firms should be especially cautious during the security update process. "Updating a website requires granting access, and that process needs a security review," Moon said. "For example, if you hire someone from outside to clean your home, shouldn't you first check whether the person you are handing your keys to is trustworthy?"

Emergency security patches applied... Vulnerability checks underway

Major South Korean IT companies, including Cafe24, Gabia, and NAVER Cloud, are currently applying emergency security patches and working to respond to client companies. South Korean security firms have also stepped up their response by issuing vulnerability alerts and offering security checks. "Although no specific cases of damage have been confirmed yet, reports indicate that attacks are underway overseas," said Yang Bongyeol, CEO of Logpresso. "We remain vigilant because this attack allows an attacker to execute commands on a server over the internet without going through a separate authentication process, such as logging in to a website. An attacker could also exploit the ability to execute server commands to steal large amounts of personal information stored on websites."

According to South Korean security firm AhnLab, approximately 110,000 hosts (servers) in South Korea are estimated to have vulnerable versions of PHP installed, the sixth-highest number worldwide. However, the figure was calculated based on data from before the security patch was released and is a conservative estimate, so the company expects that many more servers may actually be at risk.

Security experts said that SMEs with weak information security infrastructure should make it a top priority to establish a system for identifying and managing their assets. "SMEs rarely properly identify assets such as the software they own," said Park Sejun, CEO of Theori. "Companies that outsource often leave outdated software in place without proper management or security support. The government should also consider support measures at the national level, including through the Ministry of Science and ICT."

Attacks becoming routine with AI... Urgent need to redefine the role of security personnel

The concern is that the discovery of security vulnerabilities and hacking attacks driven by artificial intelligence (AI) will become routine. Experts say the rapid development of AI calls for a shift in the security paradigm and a redefinition of the role of security personnel, whose responsibilities are expected to grow. "Security staff currently spend a great deal of time reviewing numerous logs and events, identifying anomalies, creating detection rules, and determining whether an incident has occurred," said Kim Dongcheol, CEO of SoftFreak. "AI can analyze large volumes of data to identify user behavior or application programming interface (API) call patterns that differ from the norm, analyze connections between different security events, and prioritize risks for security staff to review."

However, he emphasized that people still have an important role to play in making final security decisions. "For example, even if AI identifies a particular API call as abnormal, determining whether it is an actual attack or a legitimate high-volume process related to the company's work, and what impact blocking it would have on services, requires an understanding of the company's operations and systems," Kim said. "Going forward, security personnel should move beyond being security operators who simply handle events and take on the role of designing and assessing security policies and risks."

This content was produced with the assistance of AI translation services.