Two Korean regulators issue urgent PHP patch orders within 24 hours

A flaw in PHP, the programming language behind a large share of the world's websites, drew urgent guidance from two Korean regulators on Oct. 22, a day after the PHP development team released a fix and the Korea Internet & Security Agency posted its advisory. The Ministry of Science and ICT and the Personal Information Protection Commission came at the same flaw from different sides.

The science ministry and KISA reported two vulnerabilities. An attacker can send a specially crafted request over the internet without a username or password and run commands on the server — enough to plant a remote-control webshell, leak customer data, or deface or knock out a website. Because the defect sits in PHP itself rather than in any one site's code, even carefully built sites are exposed. CERT-EU and counterparts in Britain, the Netherlands and Germany rated it critical and advised isolating or temporarily shutting down systems that cannot be patched at once.

The ministry raised the private-sector cyber threat alert from "interest" to "caution" at noon on Oct. 22 and told companies and institutions to move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, then restart their web services for the fix to take effect. PHP 8.1 and below no longer receive official updates and must be migrated to a supported version; 8.2 loses security support on Dec. 31, 2026. KISA circulated the notice to about 28,000 companies that have reported a chief information security officer, 111 major information and communications infrastructure facilities, 1,068 ISMS-certified firms, 5,900 C-TAS members and 688 web hosting companies and internet data centres. Small businesses running sites through a hosting provider were told to ask the provider whether the patch has been applied.

Vice Minister Baek Kyung-hoon said the usual cycle of manual checks followed by patching within days cannot stop an attack whose exploit code is already public, and called for immediate blocking of internet-facing assets and pre-emptive web firewall rules. The ministry said it would work with other departments on security checks for small and medium-sized businesses.

The privacy commission warned that a compromised website can expose the database behind it, singling out phpMyAdmin, a PHP-based database management tool, as the danger zone when exposed to the internet or granted excessive access rights. Its four instructions to data controllers: patch PHP and delete unneeded web services; restrict direct internet access to database tools and minimise the database rights given to web accounts; watch for bulk queries and exports of personal data; and check outsourced development, contractors and hosting environments for overlooked PHP installations.

"This vulnerability does not stop at the compromise of the website itself," said Yang Cheong-sam, the commission's secretary general. "There is concern it could lead to large-scale damage, including the leakage of many users' personal information stored in connected databases."

Because vulnerability details circulated before the patch, the ministry advised checking patched servers for unusual access logs or webshells, and warned that files offered online as proof-of-concept attack code often hide malware. Businesses running an outsourced shopping mall or a long-forgotten site may not know PHP is there at all.