A hacking vulnerability has been discovered in PHP, a programming language used by a significant number of websites worldwide, prompting the government to issue a cyber crisis alert. However, it was found that nine out of ten domestic PHP servers are running on older versions that cannot receive the security update to patch this hole.
According to data compiled on the 21st (local time) by global security firm Mallory using Shodan, a search engine that identifies internet-connected servers, 89% of the 56,423 Korean PHP servers with disclosed version information were running PHP 8.1 or below. This is more than 15 percentage points higher than the global average of 73.5%.
A Ministry of Science and ICT official stated, "While we do not have exact statistics, it is estimated that approximately 70% to 80% of domestic web pages are built using PHP." The two vulnerabilities discovered this time allow external parties to issue malicious commands to servers without logging in. Hackers could potentially steal customer information or alter websites. Security firm researchers utilizing AI identified the flaw, which had remained hidden for over a decade.
The problem lies with older versions. Although the PHP development team released security updates for versions 8.2 through 8.5 on the 21st, they are not providing updates for versions 8.1 and below, whose support period has ended. Park Se-jun, CEO of Theory, pointed out on Facebook, "There are many sites stuck on PHP versions 5 and 7, similar to old shopping malls, so greater caution is needed."
Those using older versions need to switch to newer ones, but this is not easy either. A representative from web hosting company Gabia explained, "Changing the PHP version can cause compatibility issues, such as some functions not operating properly depending on existing code, plugins, or themes," adding, "In many cases, modifying the site's source code is required to transition to a higher version."
If switching immediately is difficult, blocking external access is an alternative. The government raised the cyber crisis alert for the private sector from 'Attention' to 'Warning' by one level at 12:00 p.m. on the 22nd. Vice Prime Minister and Minister of Science and ICT Baek Hee-kwon urged via Facebook, "If updating is difficult, please consider blocking external access or suspending services."
However, a Ministry of Science and ICT official noted, "Suspending websites or services is a significant decision, making it difficult for the government to make a blanket determination." Security for public sector websites falls under the jurisdiction of the National Intelligence Service. A comprehensive survey of domestic websites has not yet been decided. The official added, "We are monitoring whether any damage reports have been received due to actual exploitation of the vulnerabilities."
Lee Gi-hyuk of Korea Security Jeong Chaek-yeon-gu (Director) stated, "All entities using PHP must be inspected regardless of their size," and noted, "The government cannot support the security measure costs for all companies." He emphasized, "The government should provide inspection tools and specific response guidelines, while companies must also fulfill their responsibility to protect their own servers and data."
On the other hand, Professor Jang Hang-bae of the Department of Industrial Security at Chung-Ang University pointed out that the comprehensive survey approach repeated with every incident needs to change. Professor Jang stated, "Because a flawless comprehensive survey is demanded of all companies and institutional investors every time an incident occurs, security personnel are burdened with overnight inspections," adding, "We must prioritize inspecting high-risk core systems, analyze the causes of incidents, and establish a system to prepare for new attacks that may occur in the future."
in TECH
