Financial-sector hacks and PHP vulnerabilities... Government to inspect security at about 170 critical facilities

[Financial News] Amid a series of cyber incidents, particularly in the financial sector, the government has launched urgent security inspections of about 170 privately operated major information and communications infrastructure facilities, including those of the country’s three telecom carriers. It will focus on vulnerable points that could provide hackers with a way in, such as servers exposed to the internet, and assess how organizations are responding to serious security vulnerabilities recently discovered in web servers. The measures are intended to proactively address security risks to critical information and communications facilities that could have a major impact on the national economy and society. 
According to government officials on the 28th, the Ministry of Science and ICT plans to inspect security vulnerabilities at about 172 facilities operated by 111 institutions responsible for managing major information and communications infrastructure in the private sector by the end of the year.
The inspections follow the president’s directive to review security systems across all of the country’s core systems, after a series of cyber intrusions and personal information leaks at financial and public institutions. The major information and communications infrastructure under review comprises core systems that could have a significant impact on national security, the economy and society if compromised. These include the wired and wireless communication services of the three telecom carriers and systems related to internet data centers (IDCs).
Taking into account the attack methods used in recent cyber incidents in the financial sector, the government plans to focus on how externally exposed assets, such as internet-facing servers and webpages, are being managed.
Serious security vulnerabilities in PHP-based web servers that have recently been disclosed in quick succession are also included in the inspections. PHP is a programming language widely used on websites around the world. A vulnerability was recently discovered that allows malicious commands to be run on a server from outside. To address the two previously disclosed vulnerabilities, PHP versions 8.2 through 8.5 must be updated to at least versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, respectively, and the running processes must be restarted. No patch is available for PHP 8.1 or earlier, whose security support has ended, so systems must be upgraded to a later version.
The government plans to assess the impact of the vulnerabilities on major information and communications infrastructure, check whether security patches have been applied, and take any necessary response measures.

[email protected] Choi Hye-rim Reporter