A severe security crisis has unfolded globally, placing 70% of websites at risk of hacking exploits. Vulnerabilities unearthed in PHP, a predominant web development language, may enable cybercriminals to infiltrate servers without the necessity of authentication.
In response, various nations are mobilizing efforts to thwart potential attacks, including the drastic measure of taking compromised websites offline. The South Korean government, alongside pertinent agencies, has initiated emergency protocols.
On October 22, the Ministry of Science and ICT (MSIT) and the Korea Internet & Security Agency (KISA) elevated the cyber crisis alert for the private sector to “Caution,” the second tier of a four-tier system encompassing Interest, Caution, Alert, and Severe.
This escalation occurred shortly after the public disclosure of two PHP vulnerabilities by developers. Authorities have since activated emergency response initiatives, increasing personnel dedicated to cyber incidents and placing emergency response teams on high alert.
“The newly identified vulnerabilities permit attackers to seize control of servers without the need for authentication, and international reports indicate that attack attempts are already underway,” stated Song Ki-ho, the third deputy national security adviser, during an emergency cybersecurity meeting convened by the National Security Office at the presidential residence. “The speed and efficacy of our response will be critical in mitigating damage,” he emphasized. “We must act promptly and collaboratively.”
PHP serves as a programming language extensively used in the development of websites and numerous web services.
For instance, when a customer searches for a product on an online retail platform, the website’s server retrieves and displays relevant results.
PHP scripts define the necessary instructions that empower the server to execute such operations. Notably, WordPress, the widely utilized website creation and management system, also relies on PHP.
According to W3Techs, a U.S. web technology analysis firm, approximately 70% of global websites leverage PHP.
The PHP developers revealed on October 21 that an internal security audit unearthed critical vulnerabilities, prompting the release of emergency patches.
Exploitation of these vulnerabilities, recognized as “PHP2Shell,” could empower hackers to execute arbitrary code remotely and compromise websites within mere seconds, bypassing separate login or authentication requirements.
In light of this crisis, governments across the world have initiated urgent countermeasures. The U.S. National Security Agency (NSA) has issued an advisory urging organizations to implement the pertinent security patches and suggesting the temporary suspension of systems if immediate updates are unfeasible.
According to reports from Reuters, various European government entities—including France’s Interior Ministry and the Netherlands’ National Cyber Security Centre—have also temporarily halted website operations.
Particular apprehension is evident in South Korea, where a significant number of websites reportedly operate on outdated versions of PHP that are ineligible for updates.
Per insights from the French cybersecurity firm CybelAngel, around 25,000 servers in South Korea employ PHP version 8.1 or earlier, accounting for 82% of servers with identifiable versions.
Given that official updates for versions 8.1 and prior are no longer available, operators are compelled to upgrade to version 8.3 or later to implement the newly issued security patches.
In response, MSIT has advised website operators to restrict external access or temporarily suspend sites if updates cannot be enacted.
Deputy Prime Minister and Minister of Science and ICT Bae Kyung-hoon underscored the urgency for prompt action on social media, warning that such vulnerabilities could jeopardize customer data and lead to website defacement.
The PHP vulnerabilities have gained additional notoriety due to their discovery via an AI model. The U.S. cybersecurity company Calif pinpointed these flaws while scrutinizing PHP source code with OpenAI’s GPT-5.6 Sol and promptly alerted the developers.
Subsequently, Wiz, a cybersecurity company affiliated with Google, corroborated and reported the vulnerabilities through an independent investigation.
Security experts had flagged the troublesome code years prior but refrained from action, deeming its exploitation in real attacks to be a formidable challenge.
The realization that AI could identify a method to manipulate the code ignited the urgency for this response.
Wiz co-founder Ami Luttwak remarked to The Wall Street Journal that these flaws represent “the most severe vulnerabilities ever unveiled via AI,” noting their complexity rendered them undetectable by human analysis alone.
It is imperative that these vulnerabilities be rectified on the servers hosting websites, as individual user computers do not require any additional software installations.
Website operators or server management firms carry the responsibility of implementing the PHP security updates.
The PHP developers have clarified that merely adjusting specific configuration settings will not adequately address the issue.
Source link: Thelec.net.
