Governments worldwide have launched emergency responses as concerns spread over cyber intrusions stemming from PHP. South Korean security authorities called for immediate inspections and security updates, and urged organizations to report any signs of compromise without delay.
The government began issuing urgent notices about the PHP security vulnerability late on the 21st, according to the Korea Internet & Security Agency (KISA) and the Ministry of Science and ICT on the 22nd. The notices went to about 28,000 companies that have registered a chief information security officer (CISO), 5,900 members of the Cyber Threat Analysis & Sharing (C-TAS) network, 1,068 companies certified under the Information Security Management System (ISMS), as well as web hosting providers and internet data centers.
The Personal Information Protection Commission asked personal data handlers operating web services to tighten database access controls and prevent mass data leaks. Because most domestic websites run on the PHP programming language, the measures aim to keep the newly discovered vulnerability from causing actual damage. "If PHP-based database management tools such as phpMyAdmin are exposed externally or excessive database access rights have been granted, attackers could exploit that to reach large volumes of personal information, so particular caution is needed," a commission official said.
Companies and institutions using PHP, along with major web hosting providers, have begun checking the PHP versions running on their websites and systems. Cafe24, which builds online shopping malls and provides web hosting, announced it would begin emergency security update work on PHP-based services from the afternoon of the 21st. Gabia, a corporate IT infrastructure services provider, completed security measures on the 22nd across all PHP versions affected by the vulnerability. NHN Cloud and Everspin also responded, inspecting their own systems and applying rules to block attacks exploiting the flaw.
Concerns about cyber intrusion damage nevertheless remain, because details of the PHP vulnerability have already circulated among hackers worldwide. "Even for servers that have been updated, check for signs of compromise such as unusual access logs or installed remote-control files, and report to KISA immediately if you suspect damage," a Science and ICT Ministry official said. Song Ki-ho, third deputy director of the National Security Office, said attack attempts have already been reported overseas and that how quickly organizations act will determine the scale of the damage. He called on the private sector, the government and the military to act as one team and complete the measures swiftly. Government checks found that public institutions and the military use PHP relatively little, leaving them safer than the private sector.
Officials also called for a fundamental change in how companies and institutions conduct cybersecurity inspections. "Attacks cannot be defended against with the conventional vulnerability management cycle of manual inspection followed by patching within a few days," said Bae Kyung-hoon, deputy prime minister and minister of science and ICT. "An automated response system is essential, including immediate blocking of internet-facing assets and preemptive application of web application firewall rule sets."
Major countries have also mounted emergency responses. Japanese Prime Minister Sanae Takaichi called for urgent action directly on X, formerly Twitter, on the night of the 21st, urging the rapid application of PHP patches. The U.S. National Security Agency advised that if an immediate update is not possible, the affected systems should be taken offline until the vulnerability is fully resolved.