〈Anchor〉

Governments and companies around the world are on high alert after a serious vulnerability was discovered in a programming language commonly used for internet websites.

The South Korean government has also launched an emergency response. Reporter Choi Seung-hun explains how this flaw allows information to be stolen in simple terms.

〈Reporter〉

When we log in to an online shopping mall or order items, there is a program like an "employee" that checks the request and returns the result.

A representative language used to create these programs is PHP.

First released in 1995, it is still widely used in shopping malls, internet bulletin boards, and blogs.

However, it has been revealed that this program makes two mistakes while handling "memory," where information is temporarily stored.

When a hacker sends a specific request to starve PHP of the memory it can use, PHP causes an error.

Problems were found where it mistakes incorrect information for normal information, or pulls out information it has already discarded as if it belonged to the next visitor.

Taking advantage of this confusion, hackers could make the server follow their commands.

This means they could steal personal information or install malicious programs even without logging in.

The development team kept the attack method a secret until the vulnerability was fixed, but the controversy arose when a security patch distribution company released the modified program six hours earlier than promised.

This is because if hackers closely examine where the fixes were made, they can figure out in reverse where the security holes originally were.

[Tai Duong / CEO, Cybersecurity Firm Calif : Now, just by looking at the security patch, you can create an attack code. Everything has changed.]

It is also an emergency in South Korea.

Cybersecurity firm AhnLab estimated that there are approximately 112,000 domestic servers installed with vulnerable PHP versions.

The government raised the cyber crisis alert to "Caution" and sent emergency notices to around 28,000 companies.

Site operators must install the fixed version of PHP and restart their server programs.

Domestic hosting companies such as Cafe24 and Gabia have also launched emergency patching.

However, older websites may stop working when updated, so small and medium-sized enterprises lacking security personnel may face difficulties in responding.

If immediate updates are difficult, measures such as temporarily blocking external access should also be considered.

(Video Editing: Won Hyung-hee, Design: Seo Seung-hyun)