"Critical Flaw in PHP"…KISA Advises Emergency Security Updates

[Anchor]

With security vulnerabilities becoming known domestically, government authorities have launched an emergency response by guiding related companies to take security measures. The Korea Internet & Security Agency announced that four versions of the programming language PHP are affected and recommended security updates.

Reporter Lee Tae-gwon has the details.

[Reporter]

PHP, in which these security vulnerabilities were found, is a programming language widely used for website creation.

It is known that about 75% of websites worldwide capable of identifying server-side programming languages use PHP. According to website technology statistics site W3Techs (Note: Aguko kept as Aguko or translated based on strict rules, let's keep Aguko as written), approximately 87% of all domestic websites—more than 140,000 sites—use PHP.

As security threats materialized, the Korea Internet & Security Agency (KISA) issued a recommendation for security updates.

KISA stated that the identified vulnerabilities consist of two cases: an 'improper exception handling' vulnerability, which fails to properly handle exception situations, and a 'use-after-free' vulnerability, which references memory that has already been freed.

It added that the affected versions are four editions including PHP 8.2, 8.3, 8.4, and 8.5. It emphasized that versions 8.1 and below have reached the end of official security support and must be upgraded to currently supported versions.

The Ministry of Science and ICT also requested security measures against the PHP vulnerabilities last night (October 21) targeting member companies of C-TAS, a cyber threat information analysis and sharing system, as well as companies obligated to appoint a Chief Information Security Officer (CISO).

C-TAS is a system operated by KISA through which about 5,900 participating companies and institutions share cyber threat information.

The security industry points out that small and medium-sized enterprises, which relatively lack security personnel and response capabilities, may experience difficulties applying patches. They advise considering the temporary blocking of external access, and urge the government to step in with support such as emergency patching.

(Video Journalist: Jeil | Video Editor: Park Chun-bae)
※ Please note: This article was translated by AI and may contain errors.