Image to help understand the article
Government activates emergency response
South Korea raised its private-sector cyber crisis alert from “interest” to “caution” after attacks began targeting two critical vulnerabilities in PHP, the widely used programming language that powers many websites.
The Ministry of Science and ICT and the Korea Internet & Security Agency, or KISA, elevated the alert at noon on Oct. 22 and activated an emergency response system. Security guidance was sent to about 28,000 companies required to register a chief information security officer and roughly 5,900 members of the country’s cyberthreat information-sharing network.
The vulnerabilities, collectively called “PHP2Shell,” stem from flaws in PHP’s memory management. Tracked as CVE-2026-109618 and CVE-2026-109619, they could allow attackers to execute malicious code on a server without authentication. They carry a severity score of 9.2 out of 10.
Attacks detected before patches arrived
Amazon’s threat intelligence team said it detected attempted exploitation on Oct. 17, four days before PHP’s developers released patches. Imperva said that during the first 24 hours after public disclosure, it recorded 482,342 related requests and 122,311 attack sessions across systems it protects. The activity targeted 21,998 websites in 103 countries, although the figures do not represent confirmed successful breaches.
Palo Alto Networks estimated that about 22 million PHP instances are exposed to the internet worldwide, while cautioning that not all of them are necessarily vulnerable.
Security companies offer free checks
South Korean cybersecurity companies released free tools and guidance to help organizations assess their exposure. Theori reproduced the attack code and published a response guide and configuration-checking script. The company warned that temporary measures may not fully block attacks and could disrupt some functions, making installation of the official patch essential.
NKWhiteHat released a scanner that checks PHP versions and configurations. Piolink opened a webpage where operators can enter a website address to check its PHP version and determine whether a patch may be needed, while Stealien introduced a similar online service. AhnLab published methods for detecting suspicious command execution, web shells and file changes.
Those external checks have limits. A server that conceals its PHP version may be difficult to assess, and a clean result cannot reveal unsafe internal settings or determine whether a system was previously compromised.
Officials urge restarts and breach reviews
KISA advised administrators to upgrade PHP to the latest secure version and then restart their web services. Programs loaded into memory before an update may remain vulnerable until they are restarted.
The agency also recommended reviewing access logs dating back to at least Oct. 20, checking for installed web shells and changing sensitive credentials such as database passwords and authentication tokens after patching.
South Korea’s Personal Information Protection Commission warned organizations to secure PHP-based database administration tools such as phpMyAdmin, particularly when they are exposed to the internet or configured with excessive privileges. It called for restrictions on outside access and reviews of unusual activity, including bulk searches or exports of personal information.
Yang Cheong-sam, the commission’s secretary-general, warned that an attack could spread beyond a website and expose personal information stored in connected databases, potentially leading to large-scale damage.
Questions over public-sector readiness
At a parliamentary audit the following day, lawmaker Han Jun-ho criticized KISA for failing to fully determine which public agencies still operated vulnerable systems or had completed updates despite the emergency warning.
KISA President Lee Sang-jung said responsibility is divided among individual agencies, creating institutional limits on the organization’s ability to directly inspect each system. Han requested a follow-up report on the government’s response.
Comments
Post a Comment