“Take over servers without a password” ... PHP security emergency hits websites worldwide

[Financial News] A critical security vulnerability has been discovered in “PHP,” a core programming language powering countless websites and online shopping malls worldwide. The flaw allows hackers to take over servers without a password, putting cybersecurity around the world on high alert.
According to foreign media, including the Associated Press, and security industry sources in South Korea and abroad, PHP developers will release an emergency update at 11 p.m. that night, Korea time, to address two serious security vulnerabilities.
The newly discovered vulnerability, nicknamed “PHP2Shell,” has a score of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS) 4.0, placing it in the highest “Critical” severity category. The flaw allows an external attacker to infiltrate a server remotely and execute malicious code at will, without going through normal authentication procedures such as logging in. Exploiting it could allow hackers to steal all of a website’s customer data or change the site’s display at will.
PHP is a technology that underpins the creation of familiar online shopping malls, corporate websites, and websites built using tools such as WordPress. Because it is so widely used across the internet, the scale of the damage could grow uncontrollably, prompting security authorities in countries around the world to act urgently.
The European Union Computer Emergency Response Team (CERT-EU) urged institutions and businesses to “apply the security update as soon as it is released,” and issued a strong warning: “If it is difficult to take action immediately, consider temporarily blocking all access to your website until the vulnerability is fixed.”
Domestic security experts also urged people to exercise particular caution. They stressed the need for thorough checks of neglected sites, warning that vulnerable, outdated versions of PHP could be lurking in websites built long ago and forgotten, or in old shopping malls developed by outside contractors. They also advised website operators not to stop at applying the update, but to make sure they check their servers for signs of unusual activity and for remote-control files (web shells) that hackers may have already secretly planted.
[email protected] Park Ji-hyun Reporter