▲ Deputy Prime Minister and Minister of Science and ICT Bae Gyung-hoon answers questions from lawmakers during a parliamentary audit by the Science, ICT, Broadcasting and Communications Committee held at the National Assembly on the 23rd.
Deputy Prime Minister and Minister of Science and ICT Bae Gyung-hoon stated that he will formulate cross-agency comprehensive measures in response to the recent discovery of a severe security vulnerability in "PHP," a widely used programming language for websites worldwide.
During the parliamentary audit by the Science, ICT, Broadcasting and Communications Committee held at the National Assembly today (the 23rd), Deputy Prime Minister Bae said, "I deeply agree with the criticism that we need to reorganize the cybersecurity control tower system." He added, "Beyond the response centered on the National Security Office, we are reviewing comprehensive cross-agency measures and related organizational restructuring."
"I believe it is necessary to establish fundamental measures that go beyond just addressing the PHP issue," Bae stated, adding that he will report the related plans soon.
Lawmakers criticized the government for its sluggish response speed, pointing out that major countries like the United States, Japan, and China moved much faster by even recommending offline transitions or access blocking for unpatchable systems, whereas South Korea remained at the "Caution" stage, leaving measures to the discretion of individual institutions.
Representative Seo Chun-ho of the People Power Party pointed out that about 80% of domestic websites use PHP, which is higher than the global average of around 70%, noting that this vulnerability—which allows servers to be hijacked even without login credentials—is directly linked to national security.
Choi Woo-hyuk, head of the Information Protection Network Policy Bureau, explained, "We issued a security notice at 11:20 p.m. on the 21st, the day the PHP Foundation made its announcement, and raised the cyber crisis alert from 'Interest' to 'Caution' the next day, requesting 28,000 Chief Information Security Officers (CISOs) and 111 major critical infrastructure facilities to apply patches."
Representative Han Jun-ho of the Democratic Party of Korea pointed out that more important than whether a crisis alert was issued is how quickly vulnerable public systems were actually identified and protected.
Lee Sang-joong, president of the Korea Internet & Security Agency (KISA), replied, "I understand that public administrative agencies mostly do not use PHP." However, he added, "The current status of vulnerable PHP versions and the patch completion rate have not yet been identified, and under current regulations, KISA does not have the authority to directly scan systems."
(Photo: Yonhap News)
※
Copying, redistribution, and unauthorized use in AI training are strictly prohibited.