The government has urged website operators to conduct emergency inspections and updates regarding PHP security vulnerabilities. To prevent hacking that exploits these vulnerabilities, it is essential not only to update to the latest version but also to check for any existing traces of intrusion.
According to the "PHP2Shell Security Vulnerability FAQ" distributed by the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) on the 26th, three security vulnerabilities have recently been identified in PHP. PHP is a programming language widely used in websites and servers, and is utilized for building homepages with platforms such as WordPress and Drupal.
The government recommended security updates for two vulnerabilities (CVE-2026-109618·109619) announced on the 21st. It also instructed that the additional vulnerability (CVE-2026-115560) announced on the 24th be addressed through security updates, and that additional security settings be applied until patches are installed.
The scope of inspection is not limited to general homepages. It also includes systems using PHP, such as corporate internal intranets, Enterprise Resource Planning (ERP), groupware, and administrator pages. Even if a login function exists, attacks are possible at stages prior to login, so operators should not feel secure.
The safe PHP versions recommended by the government are 8.5.12, 8.4.27, 8.3.36, and 8.2.35 or higher. However, since support for PHP 8.2 ends on December 31, it is recommended to transition to version 8.3 or higher. Homepages using PHP versions 8.1 or lower must also be upgraded to 8.3 or higher.
Homepage operators should verify with their production and hosting providers whether PHP is being used, the specific version, and the results of security measures. After applying security updates, the server must be restarted for the changes to take effect. Since there is a possibility of disruptions during the update process, prior backups and testing are also necessary.
Updating alone does not eliminate all risks. If an attacker has already planted malicious files on the server, those files will not be deleted even if security patches are applied. The government recommended inspecting for traces of intrusion after the 20th and replacing authentication information, including database (DB) passwords, administrator account passwords, and external service integration keys.
If immediate updating is difficult, temporary measures such as additional security settings and inspections for intrusion traces must be implemented. Even if a Web Application Firewall (WAF) is installed, it can only block some attacks and is not a fundamental solution. If necessary measures are difficult to implement, the option of temporarily suspending homepage operations should also be considered.
If hacking is suspected, the server should not be shut down immediately. Turning off the server may erase traces of the attack, making it difficult to determine the scope of damage. If screen tampering or unknown files or accounts are discovered, external access should be blocked, and a report should be filed via 118 (dial without area code) or through the Protect Korea website.
Small and medium-sized enterprises (SMEs) and small business owners can receive security consultations at 16 regional information protection support centers nationwide. They can also utilize the free homepage vulnerability inspection and hacking diagnostic tools provided by KISA's Protect Korea service.
in TECH
