[Anchor]
As security vulnerabilities have become known domestically, government authorities have launched emergency responses, such as guiding related companies to take security measures. The Korea Internet & Security Agency (KISA) announced that four versions of the programming language PHP are affected and has recommended security updates.
Reporter Lee Tae-gwon has the details.
[Reporter]
PHP, in which the security vulnerabilities were discovered, is a programming language widely used for website creation.
It is known that about 75% of websites worldwide capable of identifying server-side programming languages use PHP. According to website technology statistics site W3Techs, approximately 87% of all websites in South Korea, numbering over 140,000 places, use PHP.
As security threats became tangible, the Korea Internet & Security Agency (KISA) issued a recommendation for security updates.
KISA stated that the vulnerabilities identified this time are two cases: an "improper exception handling" vulnerability that fails to properly handle exceptional situations, and a "use-after-free" vulnerability that references memory that has already been freed.
It emphasized that the affected versions are PHP 8.2, 8.3, 8.4, and 8.5, totaling four versions. In particular, it stressed that since official security support for versions 8.1 and below has ended, upgrades must be made to supported versions.
The Ministry of Science and ICT also requested security measures regarding the PHP vulnerability last night (the 21st) to member companies of C-TAS, a cyber threat information analysis and sharing system, and companies obligated to appoint a Chief Information Security Officer (CISO).
C-TAS is a system operated by KISA through which approximately 5,900 participating companies and institutions share cyber threat information.
The security industry points out that small and medium-sized enterprises, which relatively lack security personnel and response capabilities, may experience difficulties applying patches. Therefore, they should consider temporarily blocking external access, and the government should also step in to provide support such as emergency patches.
(Video by: Jeil | Video Editing by: Park Choon-bae)
※
Copying, redistribution, and unauthorized use in AI training are strictly prohibited.