Science ministry raises cyber alert as critical PHP flaw threatens websites

The science ministry said Thursday it had raised South Korea's private-sector cybersecurity alert level from "interest" to "caution" after two critical vulnerabilities were disclosed in PHP, the programming language behind a large share of the world's websites, and urged companies and agencies to apply security updates immediately.

PHP underpins home pages, online shopping malls, message boards and administrative pages, and the popular website-building tools WordPress and Gnuboard also run on it. Because the flaws sit in PHP itself rather than in any individual website's code, even sites built with care can be exposed: an attacker can run commands on a server by sending specially crafted requests over the internet, without any ID or password, KISA said.

A successful attack could let a hacker secretly install a remote-control file known as a webshell, leak customer information, or deface or cripple a website.

The PHP development team released a security update fixing the vulnerabilities on Oct. 21, and KISA posted an advisory the same day on its Bohonara website. Operators should check the PHP version on every website and system they run and update immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, then restart their web services. Older versions, PHP 8.1 and below, no longer receive official updates, so operators must migrate to a supported version.

The agency warned that PHP may also be running on long-neglected home pages, outsourced shopping malls and equipment management screens. European Union cybersecurity agency CERT-EU and counterparts in Britain, the Netherlands and Germany rated the vulnerabilities as critical, recommending immediate updates and advising that systems which cannot be patched quickly be disconnected from the internet or taken offline temporarily.

The science ministry said it had relayed the advisory to companies that report chief information security officers, major information and communications infrastructure, companies certified under the information security management system, web hosting providers, internet data centers and members of its cyber threat information sharing group, and that it is monitoring attack trends with security firms at home and abroad.

Yang Cheong-sam, secretary general of the Personal Information Protection Commission, said the damage could spread well beyond the website itself. "These vulnerabilities raise concerns about large-scale damage, including the leakage of personal information on many users stored in connected databases," he said. "Along with security updates, we must strengthen our management systems, including checks for suspicious connections, so that people's personal information is not leaked."

Even servers that have been updated should be checked for signs of intrusion such as unusual access logs or installed webshells, and suspected damage should be reported to KISA. Small business owners whose sites run through a hosting provider should ask the provider whether the update has been applied. The public has no direct action to take beyond routine measures such as installing antivirus software and keeping security updates current. Many files circulating online as proof-of-concept attack code are fakes concealing malware, the agency warned, and should not be downloaded or run.