More than a week after critical security vulnerabilities were discovered in the PHP programming language, the patch application rate for domestic web services remains in the single digits. The emergence of additional vulnerabilities has heightened the need for follow-up checks by companies.
According to the security industry on October 27, Sentryo, an AI software company, reported that only 4.3% of the 510,914 services in Korea that can identify PHP versions are using the patched version.
Of the total 1,229,189 PHP-based services identified by Sentryo, only 22,027 are using the patched version, which is 21.2 percentage points lower than the global average of 25.5%.
The PHP vulnerabilities were first disclosed on October 21, when the PHP development team released an emergency security update to fix two remote code execution vulnerabilities that allowed external attackers to execute malicious code on servers without authentication. Both vulnerabilities were rated 9.2 on the Common Vulnerability Scoring System (CVSS).
However, on October 23, a third remote code execution vulnerability was revealed, occurring during PHP's session handling process under specific configuration conditions. According to KISA, the emergency security update released on October 21 did not resolve this issue, necessitating additional security measures.
In response, the official PHP development team has recommended disabling file upload tracking until the next regular security update is released.
On October 26, a separate security vulnerability was identified in the Brotli decompression library included in the Windows PHP distribution, which allows data to be written outside of permitted memory areas during data processing. The PHP development team has released four additional Windows distribution versions that incorporate security fixes.
Major hosting companies in Korea have also initiated urgent responses. Cafe24 applied security patches to its shopping mall services in the early hours of October 22.
A Cafe24 representative stated, "Immediately after the vulnerability information was first disclosed, we conducted checks on all managed services before the official announcement and implemented mitigation measures to reduce risks even before the patch was distributed. We have completed the application of both the official patch and subsequent patches, and no issues have been confirmed since then."
The representative added, "We have implemented a multi-layered defense system, including web firewalls on all servers, and we are continuously monitoring for any anomalies related to this vulnerability."
The security industry emphasizes that companies operating their own servers or using programs developed by external developers need to conduct separate security checks. In particular, outdated versions that have reached the end of official security support require upgrading to higher versions and checking program compatibility as a separate urgent measure.
In light of the ongoing discovery of additional vulnerabilities, KISA distributed a FAQ on October 26 for website operators regarding PHP security vulnerabilities and urged follow-up checks.
KISA advised that for the two vulnerabilities disclosed on October 21, security updates should be applied, and for the third vulnerability announced on October 24, additional security settings should be implemented until a patched version is released. Even after completing updates, existing malicious files will not be automatically removed, necessitating separate checks for breach traces.
Furthermore, if security measures have been entrusted to hosting or website development companies, operators are advised to verify the PHP version applied and whether the server has been restarted, and to consider upgrading to higher versions or temporarily suspending services for outdated systems where updates are not feasible.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.