The Ministry of Science and ICT announced plans to develop cross-agency measures to address security vulnerabilities in the PHP web development language.
During a comprehensive audit of the ministry by the National Assembly's Science, Technology, Information, Broadcasting and Communications Committee on the 23rd, Deputy Prime Minister and Minister of Science and ICT Lee Baek-hoon stated, "We take cybersecurity issues very seriously and will establish a comprehensive plan at the cross-agency level."
Opposition lawmakers pointed out that the government's cybersecurity response system is fragmented across various agencies, making swift action difficult. Representative Seo Cheon-ho of the People Power Party emphasized the need to clarify responsibilities and roles for each agency and to establish an integrated response system. Representative Choi Hyung-doo also noted the necessity of expanding inspections beyond banks to include credit card, insurance, and securities firms, while addressing gaps in security certification systems.
In response, Deputy Prime Minister Lee stated, "We are currently preparing comprehensive measures with the National Security Office as the control tower."
It was also revealed that the government lacks a clear understanding of the PHP usage status among public institutions. Representative Han Jun-ho of the Democratic Party criticized the government for failing to verify which systems are exposed to vulnerabilities and what protective measures have been implemented, stating, "If it is difficult to respond solely with the authority of the Korea Internet & Security Agency (KISA), necessary measures should have been coordinated with the Ministry of Science and ICT."
In response, KISA Director Lee Sang-jung acknowledged, "There are limitations in direct scanning due to current regulations and authority," and added that protective measures will be pursued in consultation with the government.
Meanwhile, the government explained that it took initial action following the disclosure of the PHP vulnerabilities. Choi Woo-hyuk, head of the Ministry of Science and ICT's Information Security Network Policy Office, stated, "Immediately after the PHP-related issues were announced on Wednesday afternoon, at 11:20 PM, we provided guidance to 28,000 Chief Information Security Officers (CISOs) to respond. We instructed them to upgrade patches immediately, and if that was not possible, to operate offline."
He also mentioned that the following day, the cyber crisis alert level was raised from 'Attention' to 'Caution.' The ministry directly contacted relevant companies to encourage action and noted that a PHP response meeting involving civilian, military, and government participation was also held by the National Security Office.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.