Government Orders Urgent Checks After Two PHP Security Vulnerabilities Found
Two vulnerabilities have been discovered in PHP that allow server commands to be executed without authentication. The flaws are critical security holes in PHP, the programming language used to build websites, and the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) have urged domestic companies and organizations running PHP-based web services to conduct emergency security checks.
PHP is a language used to develop a wide range of web services, including websites, online shopping malls, bulletin boards, and admin systems. WordPress and GNUBoard, both widely used in Korea, also run on PHP. The vulnerabilities in question allow attackers to send manipulated requests to servers and execute arbitrary commands without entering an ID or password. A successful attack could lead to web shell installation, customer data theft, and website defacement or outages.
The vulnerabilities originate from PHP itself, not from individual website programs. According to the government, even websites with securely managed software can become attack targets if they run a vulnerable version of PHP.
CERT-EU and agencies in the United Kingdom, the Netherlands, and Germany have assessed the vulnerabilities as critical and recommended prompt security updates. Where immediate patching is not possible, they have suggested cutting off systems' internet connections or temporarily suspending services. The PHP development team released a security update fixing the vulnerabilities on the 21st local time. KISA also issued a security advisory that day through its BoHo-Nara website.
Those running unsupported versions such as PHP 8.1 or lower must upgrade to a newer version. After updating, web services should be restarted, and server access logs should be checked for abnormal command execution and suspicious files such as web shells. If signs of a breach are found, organizations should report immediately to KISA and follow response procedures. KISA urgently notified chief information security officers (CISOs) of major companies, major information and communication infrastructure operators, ISMS-certified companies, web hosting providers, internet data centers (IDCs), and members of the Cyber Threat Intelligence Sharing System (C-TAS).
Deputy Prime Minister and Minister of Science and ICT Bae Kyung-hoon emphasized that routine vulnerability checks and after-the-fact patching alone cannot address this threat, stressing the need for automated response systems, including rapidly disconnecting internet-connected assets and proactively applying web application firewall rules. The deputy prime minister said he would consult with relevant ministries on security inspections and follow-up measures for small and medium-sized enterprises.
