Server Takeover Without Login? "110,000 Vulnerable Servers in South Korea"

[Anchor]

Global internet security is on high alert as a critical security flaw has been discovered in PHP, a widely used programming language for websites.

Reporter Choi Seung-hun breaks down everything from the attack mechanism—explaining how hackers can exploit this vulnerability and the likelihood of actual damage—to South Korea's response efforts.

[Reporter]

When we log in to an online shopping mall or order items, there is a program like an "employee" that checks the request and returns the results.

PHP is a representative language used to create these types of programs.

First released in 1995, it is still widely used today in shopping malls, internet bulletin boards, and blogs.

However, it has been revealed that the program makes two mistakes when handling "memory," where information is temporarily stored.

When hackers send specific requests to exhaust the memory available to PHP, PHP malfunctions.

Issues were discovered where it mistakes incorrect information for valid information, or retrieves previously discarded information as if it belongs to the next visitor.

Taking advantage of this confusion, hackers could manipulate servers into following their commands.

This means they could steal personal information or install malicious programs without even logging in.

The development team kept the attack method secret until the vulnerability could be fixed, but controversy erupted when a security patch distribution company released the modified program six hours earlier than promised.

This is because if hackers closely examine what was fixed, they can inversely figure out where the security holes originally were.

[Tải Dương / CEO, Cybersecurity Firm Calif: Now, by simply examining the security patch, people can create exploit code. Everything has changed.]

South Korea is also on high alert.

Cybersecurity firm AhnLab estimates that there are approximately 112,000 domestic servers installed with vulnerable PHP versions.

The government raised the cyber crisis alert to "Caution" and sent emergency notices to around 28,000 companies and organizations.

Site operators must install the updated PHP with the security issues fixed and restart their server programs.

Domestic hosting companies, including Cafe24 and Gabia, have also launched emergency patches.

However, older websites may stop functioning when updated, meaning small and medium-sized enterprises lacking security personnel may struggle to respond.

If immediate updates are difficult, measures such as temporarily blocking external access should also be considered.

Video by Won Hyung-hee | Graphics by Seo Seung-hyun
※ Please note: This article was translated by AI and may contain errors.