"Global Emergency": Government Raises Cyber Crisis Alert to 'Caution'

A critical security vulnerability has been discovered in PHP, a programming language widely used on websites around the world, allowing servers to be taken over without login credentials, triggering global and domestic alerts.

Recognizing that even attack codes have been made public, which could lead to large-scale hacking damages, the government raised the cyber crisis alert for the private sector from 'Interest' to 'Caution' today (the 22nd) and initiated an emergency response.

As the United States and the European Union recommend taking systems offline if security updates are difficult to apply, the fallout is spreading as public institutions and hospitals in Europe successively suspend the operation of their websites.

The Ministry of Science and ICT (MSIT) and the Korea Internet & Security Agency (KISA) held a crisis assessment meeting and issued the private-sector cyber crisis 'Caution' alert effective at 12:00 PM.

This decision follows the determination that because PHP is used on numerous domestic homepages and attack codes have even been made public, it could lead to large-scale hacking.

The private-sector cyber crisis alert is categorized into four stages: Interest, Caution, Alert, and Serious.

Following the issuance of the Caution alert, an emergency response system is being activated, which includes increasing cybersecurity incident response personnel and keeping emergency dispatch teams on standby.

The two agencies urgently disseminated related security measures to approximately 28,000 companies that have reported Chief Information Security Officers (CISOs), about 5,900 member companies of the Cyber Threat Information Sharing (C-TAS) system, major information and communications infrastructure facilities, Information Security Management System (ISMS) certified companies, and web hosting providers.

While continuously monitoring attack trends in cooperation with domestic and foreign security industries, they are also reviewing additional support measures such as emergency patch support for small and medium-sized enterprises.

KISA posted a PHP security update recommendation on the Bohonnara website and requested prompt action from companies and organizations operating homepages.

Minister of Science and ICT Bae Kyung-hoon stated, "Because this PHP vulnerability can affect numerous domestic homepages and attack codes have already been made public, a very urgent response is required."

He emphasized that it is difficult to fend off attacks through conventional responses alone—such as manual checks followed by patching within several days—making automated response systems essential, including the immediate blocking of systems exposed to the internet and the proactive application of web firewall rules.

The vulnerability disclosed this time is a flaw in PHP itself rather than in individual homepage programs.

Because of this, even homepages developed securely can be affected.

There is a risk that attackers can send specially manipulated requests without IDs or passwords to execute arbitrary commands on the server.

Experts point out that if an attack succeeds, it can lead to critical damage, such as installing web shells (remote control files) on servers, stealing customer information, and tampering with or paralyzing homepages.

In response to these concerns, the PHP development team distributed security updates patching the vulnerability on the 21st (local time).

Companies and organizations using PHP must check the versions of the homepages and systems they operate and update them to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or higher.

After the update, web services must be restarted for the security measures to take effect.

Older versions of PHP 8.1 and below, for which official updates are not provided, must be transitioned to supported higher versions.

Thorough checks are necessary because PHP may have been used even in homepages created long ago and left unmanaged, shopping malls built via outsourcing, or equipment management screens.

Even after completing the updates, organizations must check for signs of intrusion, such as abnormal access records or the installation of web shells, and immediately report suspected damages to KISA.

Small business owners and others using hosting services can simply check with their respective providers to confirm whether the updates have been applied.

◇ U.S.: "Go Offline If You Can't Update"… European Public and Private Websites Suspended Overseas responses are also continuing, including urgent update recommendations and preventive service suspensions.

The U.S. National Security Agency (NSA) urged systems using PHP to be identified and related patches applied immediately in a security advisory on the 21st.

It recommended taking vulnerable systems offline until the risks are sufficiently mitigated if immediate updates are difficult.

According to foreign media outlets including Reuters, several organizations in the Netherlands suspended the operation of their external-facing websites following recommendations from the National Cyber Security Centre.

The targets included the Port of Rotterdam, government portal sites, the Royal Dutch Football Association, and websites of major political parties and hospitals.

In Finland as well, government public network services were proactively taken offline.

In Denmark, Kombit, an IT company for local governments, suspended multiple services including a communication platform for public schools.

In Belgium, websites of the Ministry of Foreign Affairs, the Cybersecurity Centre, and the Flemish government and parliament also proactively halted operations.

The UK's National Cyber Security Centre (NCSC) likewise urged immediate security measures and recommended that systems difficult to patch immediately should be considered for offline transition until the risks are resolved.
※ Please note: This article was translated by AI and may contain errors.