▲ File image
A critical security vulnerability has been discovered in PHP, a widely used programming language for websites globally, allowing attackers to take over servers without requiring login credentials, triggering a state of high alert at home and abroad.
Believing that exploit codes have already been made public and could lead to large-scale hacking damages, the South Korean government raised the cyber crisis alert level for the private sector from "Interest" to "Caution" today (the 22nd) and launched emergency response measures.
As the United States and European nations recommend taking systems that are difficult to secure offline, the fallout is spreading across Europe, where public institutions and hospitals have successively suspended operations on their websites.
The Ministry of Science and ICT (MSIT) and the Korea Internet & Security Agency (KISA) issued the private sector cyber crisis "Caution" alert effective at 12:00 PM following a crisis assessment meeting held earlier today.
This decision follows concerns that because PHP is used on countless domestic websites and exploit codes have been publicly disclosed, it could lead to massive hacking incidents.
The cyber crisis alert system for the private sector consists of four stages: Interest, Caution, Alert, and Serious.
In accordance with the issuance of the Caution alert, an emergency response system is being put into operation, which includes increasing the number of personnel responding to cyber intrusion incidents and keeping emergency dispatch teams on constant standby.
The two agencies urgently disseminated related security measures to approximately 28,000 companies that have reported a Chief Information Security Officer (CISO), about 5,900 member companies of the Cyber Threat Information Sharing (C-TAS) system, major information and communications infrastructure facilities, companies certified under the Information Security Management System (ISMS), and web hosting companies.
While continuously monitoring attack trends in cooperation with domestic and overseas security industries, they are also reviewing additional support measures, such as providing emergency patch support for small and medium-sized enterprises (SMEs).
KISA posted a PHP security update advisory on the Bohanara website and requested prompt action from companies and organizations operating websites.
Bae Kyung-hoon, Deputy Prime Minister and Minister of Science and ICT, stated, "This PHP vulnerability can affect numerous domestic websites, and since the exploit codes have already been disclosed, a very urgent response is required."
He emphasized that it is difficult to fend off attacks through conventional responses alone—such as manual checks followed by patching days later—making automated response systems essential, including the immediate blocking of systems exposed to the internet and the preemptive application of web firewall rules.
The newly disclosed vulnerability is a flaw in PHP itself, rather than in individual website programs.
Because of this, websites can be affected even if they were developed securely.
There is a risk that attackers can send specially crafted requests without an ID or password to execute arbitrary commands on the server.
Experts point out that successful attacks could lead to serious damages, such as installing web shells (remote control files) on servers, stealing customer information, and defacing or paralyzing websites.
Amid these concerns, the PHP development team distributed a security update patching the vulnerability on the 21st (local time).
Companies and organizations using PHP must check the versions of the websites and systems they operate and update them to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, or higher.
After completing the update, web services must be restarted for the security measures to take effect.
Older versions of PHP 8.1 and below, which do not receive official updates, must be migrated to supported higher versions.
Thorough verification is necessary, as PHP may also have been used in outdated websites built long ago that are no longer managed, shopping malls outsourced to third parties, or equipment management screens.
Even after completing the updates, administrators should check for intrusion traces, such as abnormal access logs or the installation of web shells, and immediately report any suspected damage to KISA.
Small business owners and others using hosting services can simply check with their respective providers to see if the updates have been applied.
Responses continue overseas as well, including urgent update recommendations and preventive service suspensions.
In a security advisory issued on the 21st, the U.S. National Security Agency (NSA) urged organizations to identify systems using PHP and apply related patches immediately.
It recommended taking vulnerable systems offline until the risks are sufficiently mitigated if immediate updates are difficult.
According to foreign media outlets such as Reuters, several organizations in the Netherlands suspended the operation of their external-facing websites following recommendations from the National Cyber Security Center.
Affected entities included the Port of Rotterdam, government portal sites, the Royal Dutch Football Association, major political parties, and hospital websites.
In Finland, government public network services were also preventively taken offline.
In Denmark, Kombit, an IT company serving local governments, suspended multiple services, including public school communication platforms.
In Belgium, websites belonging to the Ministry of Foreign Affairs, the Cybersecurity Center, and the Flemish government and parliament preemptively halted operations.
The UK's National Cyber Security Center (NCSC) also urged immediate security measures, recommending that systems unable to be fixed right away should be considered for offline transition until the risks are resolved.
※
Copying, redistribution, and unauthorized use in AI training are strictly prohibited.