NIS considers recommending shutdown of public-sector systems vulnerable to PHP security flaws

[Financial News] The National Intelligence Service (NIS) is considering recommending that national and public institutions temporarily suspend system operations to address a critical security vulnerability in the PHP programming language.
As foreign security authorities, including those in the United States, recommend suspending vulnerable systems and some European public institutions have actually halted services, the response in South Korea is also expected to intensify.


The NIS said on the 27th, “After comprehensively considering the threat situation, we are reviewing whether to issue recommendations, including a temporary suspension of operations.” However, whether to recommend a temporary suspension of operations is still under review, and the specific systems to be targeted have not yet been determined.
On the 22nd, the NIS had urgently distributed a security advisory to national and public institutions detailing the versions affected by the vulnerability and the steps to address it. Along with advising each institution to apply security patches promptly, it is closely monitoring attempted cyberattacks targeting the computer networks of national and public institutions that exploit the vulnerability.
According to W3Techs, a web technology analysis company, PHP is a programming language used by approximately 75% of websites worldwide. The recently discovered critical vulnerability could allow attackers to execute malicious commands on servers remotely, making prompt security measures necessary.
The affected PHP versions 8.2 through 8.5 should be updated to 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or later, respectively. The PHP execution process should also be restarted after installing the patch. This is because vulnerable code may continue to run even after the update if existing processes remain in memory.
The problem is systems running outdated PHP versions that are no longer supported with security updates. No patch is being provided for PHP 8.1 or earlier, so those systems need to be upgraded to a later version. However, compatibility issues with existing programs could cost time and money.
Outdated PHP may also remain on websites built using PHP-based website creation tools such as Gnuboard, which is widely used in South Korea, as well as on shopping sites and administrative pages set up long ago.
Other countries have responded by recommending that systems that are difficult to patch be taken offline. In a security advisory on the 21st, the U.S. National Security Agency (NSA) urged that affected systems be taken offline until the vulnerability is fixed if an immediate update is not possible. The Dutch government portal, the website of the Royal Netherlands Football Association, Finland’s public network service and the Belgian Ministry of Foreign Affairs website are also reported to have temporarily suspended operations as a precaution.

[email protected] Hye-rim Choi Reporter