"Hurry Up"… Critical Flaw Plunge World Into Risk (Full Video)

[Anchor]

A severe security flaw has been discovered in the core technology powering countless websites worldwide, triggering a state of high alert. It is reported that if hackers exploit this vulnerability, they can take control of websites and even steal data. Governments around the world have urged the prompt installation of security updates.

Reporting from New York, this is Kim Hyunwoo.

[Reporter]

The French government portal website has ground to a halt.

The Dutch government has also blocked access to its portal site, displaying a message that it is undergoing maintenance.

Some European countries blocked access to their sites as a precautionary measure following news that a critical security flaw was found in PHP, the programming language used by about 70 percent of websites worldwide.

PHP developers announced that two flaws allowing external servers to be taken over without logging into the site had been confirmed, and rushed out a security update at 11:00 PM yesterday (October 21).

A global alert was issued after it was revealed that the flaw is so critical it scored 9.2 out of 10 on the international scale for assessing security vulnerabilities.

U.S. security authorities recommended shutting down websites entirely if updates are difficult to apply, and even the Prime Minister of Japan stepped in to urge emergency updates.

[Ryan Austin / Security Firm Researcher: Exploiting this vulnerability allows intruders to break into a website server as easily as opening a front door. They can roam freely through internal networks and commit all sorts of crimes.]

U.S. media outlets reported that artificial intelligence played a significant role in uncovering this security vulnerability.

AI was utilized to uncover a flaw whose danger was previously unrecognized.

[Tomer Schwartz / Security Firm Researcher: This is a problem that went undiscovered for 12 years. That means websites built 5 or 10 years ago still have vulnerable security.]

However, concerns are growing as relevant information was leaked on an online community on October 20, two days ahead of the scheduled security update release date, forcing developers to advance the release by a day—during which hackers reportedly attempted attacks exploiting the vulnerability.

PHP developers admitted fault, stating that they had already spotted signs of the flaw during a security audit two years ago but delayed fixes, with the response being delayed due to decision-making structures and a lack of personnel.

(Photo: Lee Hee-hoon | Video Editing: Park Chun-bae)

---
[Anchor]

As you just saw, following the discovery of the PHP security vulnerability, emergency responses have also been initiated domestically. Exactly what kind of problem is this, and how dangerous is it?

Reporter Choi Seung-hun will walk us through everything from the attack principles to our current situation.

[Reporter]

When we log in or order items on an online shopping mall, there are "staff-like" programs that check those requests and report the results.

A representative language used to build such programs is PHP.

First released in 1995, it is still widely used in shopping malls, internet bulletin boards, and blogs.

However, it has been revealed that this program makes two mistakes while handling "memory," where information is temporarily stored.

When hackers send specific requests to starve PHP of usable memory, PHP causes errors, uncovering problems where it mistakes erroneous information for normal data or retrieves discarded information as if it belonged to the next visitor.

Taking advantage of this confusion, hackers could make servers follow their commands.

This means they could steal personal information or install malicious programs even without logging in.

The development team kept the attack method confidential until the vulnerability was fixed, but controversy arose when a security patch distribution company released the modified program six hours ahead of schedule.

This is because if hackers closely examine what was fixed, they can reverse-engineer where the security hole originally was.

[Tai Duong / CEO, Cybersecurity Firm QuoDeck (Calip): Now, you can just look at the security patch and craft attack code. Everything has changed.]

There is an emergency in South Korea as well.

Cybersecurity firm AhnLab estimated that there are about 112,000 domestic servers installed with vulnerable PHP versions.

The government raised the cyber crisis alert to "Caution" at noon today and sent emergency notices to some 28,000 companies.

Website operators must install the security-patched version of PHP and restart their server programs.

Domestic hosting companies such as Cafe24 and Gabia have also launched emergency patches.

However, older homepages may stop working when updated, so small and medium-sized enterprises lacking security personnel may struggle to cope.

If immediate updates are difficult, measures to temporarily block external access should also be considered.

(Video Editing: Won Hyung-hee | Design: Seo Seung-hyun)
※ Please note: This article was translated by AI and may contain errors.