From PHP to Java and Python, Vulnerabilities Emerge One After Another... "Rapid Patch Releases Are Key"

16 Vulnerabilities in Programming Languages Disclosed in Four Days
Shared Components Across Services... One Flaw Can Trigger Cascading Risks
AI Finds Long-Standing Flaws... Rapid Patch Releases Are Key

Following PHP, security vulnerabilities have emerged one after another in major programming languages such as Java and Python, raising concerns about software security. AI is accelerating efforts to find weaknesses hidden in the software development ecosystem.

On October 26, the Korea Internet & Security Agency (KISA) recommended a temporary measure for a third vulnerability in PHP. The remote code execution vulnerability occurs during session processing, which maintains users' login status and other information. It can be exploited to execute malicious commands by abusing a feature that records file upload progress while processing session data. The vulnerability was disclosed after patches for two earlier vulnerabilities known as "PHP2Shell" were distributed, and no security update has been released yet.

Since a PHP vulnerability was disclosed on October 21, advisories on vulnerabilities have also followed for development environments such as Java, Node.js, GitLab, and Laravel. In the four days through October 24, a total of 16 vulnerabilities in major programming languages were officially disclosed and patched. Ten of them involved Node.js, a JavaScript runtime environment. The flaw known as "Node2shell" was found in a tool for decompressing data. When an attacker-crafted compressed file is extracted and read, the program could stop running or leak information, among other possible consequences.

In Python, a problem emerged in the process of verifying digital certificates, which confirm the identity of a communication partner. There is a risk that a compromised certificate could be trusted, causing a fake server to be accepted as legitimate. Python added a feature to its standard module for internet communications that automatically blocks such certificates.

GitLab, which developers use to store source code and collaborate, was also the subject of a security warning. GitLab fixed a flaw that could allow an unauthenticated attacker to execute malicious commands by exploiting an error in the processing of certain character patterns. The vulnerability received a perfect score of 10 out of 10 under the Common Vulnerability Scoring System, indicating a high level of risk.

Because flaws in common components can affect multiple services at once, operators are now expected to check not only their own code but also the runtime environments, external libraries, and development tools used to run their programs.

Improvements in AI's security analysis capabilities are cited as one factor behind the faster discovery of vulnerabilities. AI is being used to identify suspicious areas in vast amounts of code and verify whether they could lead to actual attacks, bringing previously undetected risks to light. The Electronic Frontier Foundation (EFF), a U.S. nonprofit organization, said that about 400,000 publicly disclosed vulnerabilities (CVEs) had been recorded in the National Vulnerability Database since 1988, and that 13,000 new CVEs had been discovered this month. It forecast that the number of vulnerabilities reported by year-end would exceed one-quarter of the cumulative total.

As flaws that remained undiscovered for a long time are being found one after another, calls are growing to address "technical debt" by reviewing and fixing accumulated security problems in existing code. Kim Seungju, a professor at Korea University's Graduate School of Information Security, said, "When vulnerabilities are discovered and analyzed, and other execution engines are checked for similar problems, additional flaws are coming to light." He added, "The issue is that developers need to create update code and provide patches quickly."

This content was produced with the assistance of AI translation services.