Security concerns have escalated among domestic companies following the disclosure of a critical vulnerability in the PHP programming language. This flaw, stemming from the PHP engine itself, raises fears that businesses may struggle to verify breaches and apply necessary security patches.
Experts in the security industry have noted that typical application logs make it difficult to trace attack footprints, and companies using outdated PHP versions may need to modify their operating systems or existing programs during the patching process.
According to security firms, the two recently disclosed PHP vulnerabilities have been rated 9.2 on the Common Vulnerability Scoring System (CVSS), categorizing them as 'Critical.' These include a flaw related to improper exception handling and a vulnerability that allows the use of freed memory.
PHP is widely used for developing various web services, including websites, online shopping platforms, and forums. According to Wiz, a security company, approximately 70% of websites globally utilize PHP. Popular platforms in South Korea, such as WordPress and Gnuboard, also operate on PHP.
The vulnerabilities are particularly concerning because they originate from the PHP engine itself, rather than specific security settings of individual websites or applications. Attackers can execute malicious code remotely under certain conditions without requiring a separate login or user interaction.
A representative from a security firm stated, "No matter how securely an application is developed, if it operates on a vulnerable version of PHP, it can still be affected. Even if server takeover does not occur, memory leaks could expose critical information such as database passwords and API keys."
The security industry is advising companies to check the PHP versions used on their websites and servers, and to apply security patches while also assessing potential breaches.
The difficulty in determining whether a breach has occurred adds to the burden on companies. The vulnerabilities arise from the PHP engine, which operates at a lower level than web applications, making it challenging to identify attack traces using standard application logs.
SGA Solutions has issued an 'Emergency Security Advisory and Response Guide' regarding PHP2Shell, outlining key indicators for assessing potential breaches. Key areas to monitor include unusually long or corrupted PHP session cookies (PHPSESSID), repeated HTTP 500 errors, and frequent restarts of PHP worker processes. Even if no abnormal signs are detected, the possibility of a breach cannot be ruled out, necessitating a comprehensive analysis of web server and web application firewall (WAF) request and response logs, as well as PHP error logs.
Challenges are also anticipated in applying security patches. Security updates have been provided for PHP versions 8.2 and above, but companies using PHP versions 8.1 and below, which are no longer officially supported, must apply separate source patches or upgrade to higher versions. Older web services may require modifications to their operating systems or existing application code due to changes in PHP versions.
A representative from another security firm remarked, "For services established a long time ago, upgrades to the operating system, changes to the PHP version, and modifications to existing code may all be necessary. The patching process is expected to be complex."
Security experts are recommending temporary security measures, such as restricting external access and strengthening WAF settings, for companies that find immediate patching challenging. However, they emphasize that temporary measures alone cannot fully resolve the vulnerabilities, and companies should secure a timeline for updates while also checking for signs of breaches, such as the installation of web shells (PHP files).
Industry sources indicate that the vulnerabilities were discovered by a security researcher using artificial intelligence (AI). This highlights the need for companies to respond swiftly to security checks and patch applications as AI becomes increasingly utilized in vulnerability detection.
Professor Yeom Heung-yeol from Soonchunhyang University stated, "The recent PHP vulnerability was identified by a security researcher using AI, demonstrating that we are entering an era where AI can detect security vulnerabilities. Both public institutions and private companies must quickly assess whether their systems and websites are affected by this vulnerability."
Professor Yeom further emphasized the importance of confirming the feasibility of applying security patches and taking necessary actions.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.