Serious security vulnerabilities have been found in PHP, the programming language used by more than 70% of websites worldwide. As governments scramble to respond, South Korea raised its cyber crisis alert for the private sector to the second level. Domestic companies and institutions have begun rolling out security updates, while the government said it is weighing additional steps such as support for smaller businesses.
Bae Kyung-hoon, deputy prime minister and minister of science and ICT, said on X, formerly Twitter, on the 22nd that the two serious vulnerabilities discovered in PHP allow malicious commands to be executed on servers from outside without logging in. To prevent damage, he said, the private-sector cyber crisis alert would be raised from the first level, "attention," to the second level, "caution," effective at noon. PHP is a programming language used to build websites, and a successful attack exploiting the newly found flaws could lead to leaks of customer information and website outages.
With the alert raised, the government has moved to emergency footing, adding incident-response staff and keeping rapid-response teams on standby. The Ministry of Science and ICT said it would first consider ordering security inspections and remedial measures at small and medium-sized enterprises. The National Security Office held an emergency cybersecurity meeting with private-sector, government and military officials to discuss responses, including temporary protective measures for websites unable to patch immediately and checks for signs of intrusion. ▷See Page 2