Global PHP Security Emergency: S. Korea Raises Cyber Alert to 'Caution'

A global emergency has been triggered after a critical security vulnerability was discovered in PHP, a programming language widely used for websites worldwide, allowing attackers to seize servers without login credentials.

Recognizing that the exploit code has already been made public and could lead to large-scale hacking damages, the South Korean government raised the cybersecurity alert level for the private sector from "Interest" to "Caution" today (October 22) and launched an emergency response.

As the United States and European countries recommended taking systems offline where security updates are difficult, repercussions are spreading in Europe with public institutions and hospitals suspending operations of their websites one after another.

The Ministry of Science and ICT (MSIT) and the Korea Internet & Security Agency (KISA) held a crisis assessment meeting and issued the private-sector cybersecurity "Caution" alert effective at 12:00 PM.

This decision was made based on the judgment that PHP is used on numerous domestic homepages and the release of exploit code could lead to large-scale hacking.

The cybersecurity alert system for the private sector consists of four levels: Interest, Caution, Alert, and Serious.

Following the issuance of the "Caution" alert, an emergency response system is being activated, which includes increasing the number of cyber-incident response personnel and placing emergency dispatch teams on standby.

The two organizations urgently disseminated relevant security measures to approximately 28,000 companies required to report a Chief Information Security Officer (CISO), about 5,900 member companies of the Cyber Threat Information Sharing (C-TAS) system, major information and communications infrastructure facilities, companies certified under the Information Security Management System (ISMS), and web hosting companies.

While continuously monitoring attack trends in cooperation with domestic and international security industries, they are also reviewing additional support measures such as emergency patch support for small and medium-sized enterprises.

KISA posted a PHP security update advisory on the Bohenara website and requested swift actions from companies and organizations operating websites.

Bae Kyung-hoon, Deputy Prime Minister and Minister of Science and ICT, stated, "As this PHP vulnerability can affect numerous domestic homepages and the exploit code has already been made public, an extremely urgent response is required."

He went on to emphasize that it is difficult to defend against attacks through conventional responses alone—such as manual checks followed by patching within several days—making automated response systems essential, including immediate blocking of systems exposed to the internet and preemptive application of web firewall rules.

The vulnerability disclosed this time is a flaw in PHP itself, rather than in individual website programs.

Because of this, websites can be affected even if they were developed securely.

There is a risk that attackers can send specially crafted requests without IDs or passwords to execute arbitrary commands on the server.

Experts point out that successful attacks can lead to critical damage, such as installing web shells (remote control files), stealing customer information, and defacing or paralyzing websites.

In response to these concerns, the PHP development team distributed a security update patching the vulnerability on October 21 (local time).

Companies and organizations using PHP must check the versions of the homepages and systems they operate and update them to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or higher.

After the update, web services must be restarted for the security measures to take effect.

Older versions of PHP 8.1 and below, for which official updates are not provided, must be transitioned to a supported higher version.

Thorough checks are necessary as PHP may have been used in homepages created long ago and left unmanaged, outsourced shopping malls, or equipment management screens.

Even after completing the updates, administrators must check for signs of breaches, such as abnormal access logs or web shell installations, and immediately report any suspected damage to KISA.

Small business owners and others using hosting services can simply check with their respective providers to confirm whether the updates have been applied.

Responses overseas also continue, including emergency update advisories and preventative service suspensions.

The U.S. National Security Agency (NSA) urged systems using PHP to be identified and related patches applied immediately in a security advisory on October 21.

It advised that if immediate updates are difficult, the affected systems should be taken offline until the risks are sufficiently mitigated.

According to foreign media outlets including Reuters, several organizations in the Netherlands suspended operations of their external-facing websites following recommendations from the National Cyber Security Centre.

Affected targets included the Port of Rotterdam, government portals, the Royal Dutch Football Association, major political parties, and hospital websites.

In Finland, government public network services were also preventatively taken offline.

In Denmark, Kombit, an IT company serving local governments, suspended multiple services including a communication platform for public schools.

In Belgium, websites of the Foreign Ministry, the Cybersecurity Centre, and the Flemish Government and Parliament preemptively halted operations.

The UK National Cyber Security Centre (NCSC) similarly urged immediate security measures, advising that systems unable to be addressed right away should consider taking them offline until the risks are mitigated.
※ Please note: This article was translated by AI and may contain errors.