Global Websites on High Alert Over Hacking Threats
Critical Flaws Put South Korea Sixth Worldwide in Vulnerable Hosts
U.S., EU Issue Warnings; Some Websites Shut Down as Precaution
KISA Urges Immediate Security Updates
The discovery of critical security vulnerabilities in PHP, a programming language widely used by websites, has triggered a global hacking alert. Major countries have recommended emergency patches or even temporarily shut down websites to prevent attacks exploiting the vulnerabilities.
South Korea has been found to have approximately 110,000 hosts believed to be running vulnerable versions of PHP, the sixth-highest number in the world. The South Korean government has also moved quickly to respond through joint public-private efforts. Experts advise focusing on minimizing damage by applying patches promptly.
According to industry sources on Oct. 22, global cybersecurity companies, including Calif and Wiz, used artificial intelligence (AI) to uncover PHP flaws that had gone undetected for more than a decade. As hackers' attempts to exploit the vulnerabilities were also detected, governments and security companies around the world took emergency response measures.
PHP is a programming language used to develop various web services, including websites, online shopping malls, online forums and administrative pages. According to web technology analysis company W3Techs, approximately 75% of websites whose server-side programming languages can be identified use PHP. WordPress, which powers approximately 43% of all websites, also operates on PHP.
The two vulnerabilities reported this time pose serious risks because attackers can execute commands of their choosing on servers by sending specially crafted requests over the internet without a username or password. Successful attacks could allow hackers to secretly install remote-control files known as web shells on servers, potentially leading to serious damage, including customer information leaks, website defacement and service disruptions.
Both vulnerabilities received a score of 9.2 under the Common Vulnerability Scoring System (CVSS), placing them in the highest severity category, “critical.”
Countries around the world responded immediately. The U.S. government recommended taking affected systems offline if security updates could not be applied quickly. The European Union (EU) also issued a joint warning, while some public-sector websites in Germany, France, the Netherlands and Finland were temporarily shut down as a precaution.
South Korea also responded swiftly through public- and private-sector measures. According to AhnLab TIP, a cyberthreat intelligence platform, 112,183 hosts running vulnerable PHP versions were detected in South Korea, accounting for 4.35% of the global total. The country ranked sixth, following the United States with 548,420 hosts (21.27%), China with 235,906 (9.15%), Germany with 193,470 (7.50%), Japan with 151,039 (5.86%) and France with 121,706 (4.72%).
The Ministry of Science and ICT (MSIT) issued a “Caution” cyber crisis alert for the private sector at noon on Oct. 22 to raise awareness of the possibility of large-scale hacking and enable a proactive response.
In the private sector, hosting provider Cafe24 implemented temporary protective measures on servers running PHP 5.4 or later starting at 11:30 a.m. on Oct. 21, before the official patches were released. The company applied additional security settings that afternoon and began rolling out official patches in stages. Another hosting provider, Gabia, also began emergency security patching at midnight on Oct. 22.
The Ministry of the Interior and Safety explained that the impact of the PHP vulnerabilities on South Korea's public sector is relatively limited because most public-sector systems use the Java-based e-Government Standard Framework. Nevertheless, security authorities are closely monitoring the situation, given the large number of information technology (IT) assets potentially exposed to the threat.
Experts advised organizations to review their use of PHP, particularly small and medium-sized enterprises with limited in-house cybersecurity capabilities and websites that have not been maintained for extended periods. They also recommended upgrading outdated versions and strengthening vulnerability management.
“It is important for all organizations using PHP, including businesses and public institutions, to promptly identify the versions they are running and apply security updates,” said Bae Seung-kwon, head of the Vulnerability Management Center at the Korea Internet & Security Agency (KISA).
“Each organization must recognize the vulnerabilities and quickly take the necessary measures,” Bae emphasized.
