Lawmakers from both ruling and opposition parties unanimously urged the government to take proactive measures regarding the recent discovery of a PHP security vulnerability. The call goes beyond merely identifying the vulnerability and recommending security patches; it emphasizes that the government should directly identify and address vulnerable points.
At the comprehensive audit of the Ministry of Science and ICT held on the 23rd at the Seoul Yeouido National Assembly, People Power Party lawmaker Seo Cheon-ho stated, "A global hacking disaster is feared due to security vulnerabilities in PHP programs related to website creation," adding, "Approximately 80 percent of websites in our country use this program."
PHP is a type of general-purpose programming language used for creating homepages. It has been found that 75 percent of homepages worldwide use it. It is primarily used within websites to verify specific user requests and retrieve and process data from servers. Recently, as security vulnerabilities in PHP have emerged, confusion has continued globally, with security patch recommendations being issued.
Seo expressed disappointment that "our government advocates for becoming a top-three AI (artificial intelligence) power, yet it only became aware of an issue raised globally recently." He criticized, "Our government's response is essentially telling each institutional investor to handle it well on their own. The approach to dealing with the situation is far too complacent and slow."
Choi Hyeong-du, a People Power Party lawmaker serving as the opposition floor leader, also criticized, "If we are an AI digital powerhouse of our stature, we should have grasped this movement from the pre-patch (security) gap period." He added, "We merely mechanically conveyed that 'a patch exists.'" Seo argued, "Japanese Prime Minister Takaishi personally posted on X (formerly Twitter). All public officials in our country (including the President) must also post (warning messages)."
Seo pointed out that a large-scale personal information breach (hacking) incident occurred at Lotte Card immediately after the government's Information Security Management and Personal Information Protection System (ISMS-P) certification. He criticized, "The Financial Services Commission quickly blocks and responds when damages occur, but the Ministry of Science and ICT and KISA (Korea Internet & Security Agency), which are in charge of the certification system, merely repeat that improvements are 'planned.'"
Han Jun-ho, a Democratic Party of Korea lawmaker serving as the ruling party floor leader, also questioned KISA Director Lee Sang-jung, stating, "The important issue is not whether an alert was issued, but how quickly and effectively vulnerable public systems were actually identified and protected." He asked, "Do you have a grasp on how many vulnerable PHP versions there are currently and how many cases have completed patching?"
Seo criticized, "The United States recommended switching to offline for systems where patching is impossible, and there are similar cases in the United Kingdom." He added, "If these issues arise, we must take responsibility and discuss with the government how to proceed with parts that cannot be handled independently."
Vice Prime Minister Baek said, "The government also considers cyber security very seriously and believes it is necessary to formulate measures that go beyond the PHP issue." He added, "We will establish a comprehensive measure plan at the inter-ministerial level and report on it."
in TECH
