A total of 24,591 servers in South Korea are running outdated versions of PHP, a programming language with a flaw that allows hackers to seize control of servers without logging in, according to an analysis released by a French security firm.
CybelAngel, a French security company, said on the 21st local time that about 2.24 million servers worldwide expose PHP, based on data from the security search engine Shodan as of the 20th. Of the roughly 1.5 million servers whose versions could be identified, 883,717, or 59%, were running outdated versions for which no fix has been released. About 740,000 servers concealed their version, meaning the actual scale of exposure could be larger, the firm said.
By country, 24,591 internet-connected servers in Korea are running PHP 8.1 or earlier, versions for which update support has ended. That accounts for 82% of domestic PHP servers whose versions were identified, the second-highest share among the top 10 countries analyzed, trailing only Algeria at 100%. China followed at 75%, Hong Kong at 70% and Japan at 61%.
No domestic damage has been confirmed so far. By the number of vulnerable outdated servers, Korea ranked eighth, behind the United States with 228,770, China with 67,306 and Japan with 55,460.
By hosting provider, PHP servers were concentrated at a handful of companies, including Amazon with 293,480, Hostinger with 142,401 and Alibaba Cloud with 81,078, making patching at the provider level important, CybelAngel said. The figures count servers rather than websites. Servers that concealed their version were excluded from the tally, and the numbers are CybelAngel's own estimates, which differ from counts by other organizations.
Update Versions and Restart Web Services
The newly discovered PHP vulnerability allows an attacker to execute arbitrary commands on a server by sending a specially crafted request without a user ID or password. A successful attack could lead to serious damage, including the installation of a web shell for remote control, theft of customer data, and the defacement or shutdown of websites.
In response to those concerns, the PHP development team released a security update fixing the vulnerability on the 21st local time. Companies and institutions using PHP should check the versions running on their websites and systems and update to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later. Web services must be restarted after the update for the security measures to take effect. Versions of PHP 8.1 or earlier, for which no official update is provided, should be migrated to a supported higher version. Careful checks are needed because PHP may also be used in long-neglected websites, outsourced online shopping malls and equipment management interfaces.
The Korean government, concluding that large-scale hacking damage could occur now that attack code has been made public, raised its cyber crisis alert for the private sector to "caution" from "attention" on the 22nd and launched an emergency response. The United States and Britain have recommended taking systems offline where security updates are difficult, while in Europe the fallout is spreading, with websites of public agencies and hospitals suspending operations one after another.