Overseas, sites are blocked in PHP…No plan for Korea

In contrast, the South Korean government has yet to present a concrete inter-agency response plan even after issuing a cyber crisis alert. In South Korea, where PHP usage is higher than the global average and many older versions have reached end-of-support status, there are calls for the government to take active measures before the damage spreads. Deputy Prime Minister and Minister of Science and ICT Bae Kyounghun is responding to lawmakers' questions during a parliamentary audit of the Ministry of Science and ICT and others held on October 6 at the National Assembly's Science, Technology, Information and Broadcasting and Communications Committee in Yeouido, Seoul. /News1 According to the security industry on the 26th, the newly discovered vulnerability is highly dangerous because hackers can execute malicious commands on a web server without using an ID or password.

If successful, it can install a malicious file called a webshell that remotely controls the server to extract customer information or paralyze the website. In response, the PHP development team released a security update on October 21 (local time). The European Union’s cybersecurity agency (CERT-EU) and cybersecurity bodies in major countries such as the United Kingdom, the Netherlands, and Germany also rated the vulnerability as critical and recommended an immediate update.

Systems that were difficult to update were disconnected from the internet or temporarily shut down. In the Netherlands, Germany, France, and other countries, government agencies and companies have proactively suspended the operation of their websites. The European Patent Office (EPO), the Internet Corporation for Assigned Names and Numbers (ICANN), and ETH Zurich also blocked access to some services.

In contrast, the response at home has been somewhat lukewarm. The Ministry of Science and ICT, after a crisis assessment meeting with the Korea Internet & Security Agency (KISA), issued a caution cyber crisis alert for the private sector starting at noon on the 22nd, but has not announced a detailed inter-agency response plan. Cyber crisis alerts in the private sector are divided into four levels: ‘Attention→’ ‘Caution→’ ‘Warning→’ and ‘Severe.’ The problem is that domestic websites are at a relatively higher risk of being exposed to PHP vulnerabilities.

According to the global web technology research firm W3Techs, the proportion of PHP usage on websites using Korean servers was 82.6%, higher than the global average of about 69%. A survey by the French security firm CybelAngel also found that 82% of PHP servers in Korea had ended security support, the second highest in the world after Algeria (100%). A security industry official said, “The problem is that many older versions of PHP are still in use domestically,” adding, “There is also a possibility of fake attacks where malicious files are uploaded to the internet and disguised as test code.” Another official assessed, “Most financial institutions have already implemented the update, so it appears that no major incidents have occurred yet,” but added, “The possibility of the vulnerability being exploited still remains.” Both ruling and opposition parties criticized the Ministry of Science and ICT for its passive response during this year's audit.

People Power Party lawmaker Seo Cheon-ho criticized, “The response is too slow, and the government’s view of the recent cyberterrorism is far too complacent.” Democratic Party lawmaker Han Jun-ho also criticized, saying, “What matters is not whether an alert was issued, but how quickly the vulnerable public system was actually identified and protected.” Deputy Prime Minister and Minister of Science and ICT Bae Kyounghun stated that he would review the preparation of a comprehensive inter-ministerial plan and organizational restructuring. Experts warned that the response should not be delayed on the grounds that no large-scale damage has yet been confirmed in the country.