The government has issued a "Caution" level cyber crisis alert for the private sector after a critical security vulnerability was discovered in PHP, a programming language widely used on websites around the world. This particular vulnerability allows commands to be executed on servers without separate authentication, posing risks such as customer data leaks and website outages, which necessitates heightened vigilance.
The Ministry of Science and ICT announced that it issued the "Caution" level cyber crisis alert for the private sector starting at noon on the 22nd, following a crisis assessment meeting with the Korea Internet & Security Agency (KISA). Cyber crisis alerts are classified into four levels: Interest, Caution, Warning, and Serious.
In response to this measure, the government will activate its emergency response system by increasing the number of intrusion response personnel and keeping emergency dispatch teams on standby at all times.
The two PHP vulnerabilities disclosed this time pose a significant risk because they allow attackers to execute desired commands on servers using specially crafted requests without going through any authentication process. Hackers could install remote control files, known as web shells, on servers, steal customer information, or tamper with and disable websites. In particular, because the vulnerabilities were found in PHP itself rather than in individual websites, sites may be affected even if they were developed securely.
Cybersecurity institutional investors in major countries, including the European Union, the United Kingdom, Germany, and the Netherlands, also assessed this vulnerability as being at a critical level. They are recommending immediate updates while advising that systems for which action is difficult should be disconnected from the internet or temporarily suspended.
The PHP development team distributed a security update resolving the vulnerabilities on the 21st. The affected versions range from PHP 8.2 to 8.5, and users must update to at least versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, respectively. Versions of PHP 8.1 or lower, for which official security support has ended, should be migrated to higher versions.
The government recommended that after updating, users check for abnormal access logs and the presence of web shells, and report any suspected intrusions to KISA.
The government urgently disseminated relevant information to approximately 28,000 companies reporting under the Chief Information Security Officer (CISO) system, 111 critical information and communications infrastructure facilities, 1,068 companies certified in the Information Security Management System (ISMS), and 5,900 member companies of the Cyber Threat Information Sharing System (C-TAS). The scope also included 688 major companies, such as web hosting providers and Internet Data Centers (IDCs).
Vice Prime Minister and Minister of Science and ICT Bae Kyung-hoon stated, "Given that attack code has already been made public, extremely urgent response is required," adding, "The conventional vulnerability management cycle of manual inspection followed by patching within a few days cannot defend against attacks." He further noted, "Automated response systems are essential, such as immediate blocking of internet-facing assets and the preemptive application of Web Application Firewall (WAF) rules," and said, "We plan to discuss security inspections and action requests for SMEs in cooperation with various ministries."
in TECH
