S. Korea raises cybersecurity alert level as PHP flaw sparks global security concerns

Seoul, Oct 22 (IANS) South Korea’s science ministry on Thursday raised the country’s cyber crisis warning level up a notch, as it joined global efforts to address two critical cybersecurity flaws involving PHP, a programming language that powers most of the internet.

The warning level was raised to “caution,” the second lowest in its four-tier system, as of noon, while companies and government agencies were requested to carry out updates to safely patch their systems, according to the ministry, reports Yonhap news agency.

“The flaw found in PHP could affect a number of websites and requires an urgent response as exploit codes have already been made publicly available,” Science Minister Bae Kyung-hoon was quoted as saying in a release.

The latest measure comes a day after government agencies and companies worldwide shut down websites due to the vulnerabilities, which came to light by utilizing artificial intelligence (AI). Cybersecurity firm Wiz — one of the companies whose researchers uncovered the flaws — described them as the “most sever” vulnerabilities ever detected by AI.

PHP, shorthand for Hypertext Preprocessor, powers a vast number of platforms, including online shopping malls, Wikipedia and WordPress — an open-source content management service behind many websites, such as blogs.

The flaw discovered Wednesday could allow attackers to control affected web servers without authentication, helping them carry out major cyberattacks, such as data leakage, system shutdown and website defacement, the science ministry explained.

Developers of the PHP platform have rolled out patches to fix the vulnerabilities, and the Korea Internet & Security Agency (KISA) posted a security update advisory.

The presidential office’s National Security Office (NSO) subsequently held an emergency meeting to coordinate the government’s response to cyber threats related to PHP, the presidential office said.

The meeting reviewed PHP use by the public, private and defence sectors and their respective response measures, while participating government officials pledged to cooperate in sharing related information and coordinating responses.

Public institutions and the military remained relatively secure from PHP-related threats as they have low rates of PHP use, the office said.

–IANS

na/