“A server restart is essential after a PHP patch ... if you can’t update, you must shut down the site”

[Financial News] The discovery of a critical security vulnerability in PHP, a programming language widely used on websites around the world, has prompted calls for swift action from small and midsize businesses and website operators using older PHP versions.
In particular, recommendations are being made to restart web services after applying the security patch and, if an immediate update is difficult, to consider blocking external access or temporarily suspending service.
There have also been a succession of cases overseas in which websites were taken offline as a precaution.
According to the security industry on the 23rd, the PHP development team released an emergency patch on the 21st to fix two security vulnerabilities known as “PHP2Shell.” Each vulnerability scored 9.2 under the Common Vulnerability Scoring System (CVSS), placing them in the highest risk category, “Critical.” The vulnerabilities could allow an attacker to execute arbitrary commands on a server remotely without separate authentication, potentially leading to personal information being leaked or a website being defaced or disrupted.

The first things website operators should check are the PHP version installed on their servers and whether the security patch has been applied. PHP versions 8.2 through 8.5, in which vulnerabilities were found, should be updated to at least versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, respectively.
In particular, the PHP execution process must be restarted after installing the patch. Even if the update files have been installed, vulnerable code may continue running if an existing PHP process remains in memory. Depending on the web server environment, operators should restart the relevant services and check which version is actually running.
The problem lies with small and midsize business websites and online shopping malls built long ago. Older PHP versions may remain on sites built using PHP-based website development tools such as Gnuboard, which is widely used in Korea, as well as on shopping malls or management pages developed by contractors.
In particular, official security support has ended for PHP 8.1 and earlier, so this patch is not available for those versions. They must be upgraded to a later version, but compatibility issues with existing programs could entail time and cost.

Foreign security authorities are therefore recommending that services be suspended on systems that are difficult to update. In a security advisory issued on the 21st, the U.S. National Security Agency (NSA) urged operators to take affected systems offline until the vulnerability is fixed if an immediate update is not possible.
There have also been cases overseas in which websites were temporarily taken offline as a precaution. Examples include the Dutch government portal, the Dutch Football Association’s website, a public network service in Finland and the Belgian Foreign Ministry’s website.
The Korea Internet & Security Agency (KISA) also called for measures to prevent further damage. In emergency response guidelines released on the 22nd, KISA recommended checking server access logs and whether malicious files had been installed from the 20th, when information about the vulnerability was disclosed, onward—and checking earlier logs as well, if possible. It also advised changing key credentials, including database (DB) and administrator account passwords. If an immediate update or temporary security measures are difficult, it urged operators to consider blocking external access or temporarily suspending service.

[email protected] Choi Hye-rim Reporter