Korea's privacy watchdog urges PHP patch after PHP2Shell flaw

The Personal Information Protection Commission said Thursday it had urged public institutions and private companies to patch a newly disclosed PHP vulnerability, warning that exploitation could reach beyond a compromised web server to the personal data stored in linked databases.

The flaw, published on Oct. 21 and named PHP2Shell, allows an attacker to run arbitrary commands on a web server without a separate login or authentication step, the commission said. PHP is widely used to build and run web services, and the commission said a breach could expose user information held in the databases those services connect to. The science ministry and the Korea Internet & Security Agency issued guidance on how to respond.

The sharpest risk sits with PHP-based database administration tools such as phpMyAdmin. Where those tools are exposed to the internet or where database accounts have been given excessive access rights, an attacker could reach large volumes of personal information.

"This vulnerability does not stop at the compromise of a website itself; there is a concern that it could lead to large-scale damage, including the leakage of personal information belonging to many users stored in the database connected to it," said Yang Cheong-sam, secretary general of the commission.

Its first instruction was to check the version of every system running PHP and apply the latest security patch, and to delete web services that are no longer needed. Operators were also told to cut off direct internet access to database management tools including phpMyAdmin, update that software and clear out unnecessary configuration files, and to keep the database permissions granted to web service accounts to the minimum required.

The commission further asked handlers to watch for abnormal access to personal information databases, including bulk queries and exports, and to strengthen detection and blocking of suspicious behaviour along with the management of access logs. The same checks should cover PHP software used in outsourced development and operations, in systems run by contractors and in hosting environments.

"Along with security updates, we must strengthen our management systems, including checking for suspicious connections, so that people's personal information is not leaked," Yang said.

The Korea Internet & Security Agency posted a security update advisory for PHP products on Oct. 21 and guidance for companies on responding to PHP2Shell on Oct. 22.