The Personal Information Protection Commission urged personal data handlers, including public institutions and private companies, to take protective measures to prevent personal data leaks linked to a recently disclosed PHP security vulnerability.

The vulnerability, disclosed on Oct. 21 and dubbed "PHP2Shell", allows attackers to run arbitrary malicious commands on web servers without separate login or authentication procedures.

PHP is widely used to develop and operate web services, and if the flaw is exploited it could lead not only to web server compromise but also to leaks of user personal information stored in linked databases. The commission warned that if PHP-based database management tools such as phpMyAdmin are exposed externally or granted excessive database access privileges, attackers could exploit them to access large amounts of personal data, calling for special caution.

The commission urged organisations to check the version of systems using PHP, apply the latest security patches and delete unnecessary web services.

It also called for restricting direct internet access to database management tools such as phpMyAdmin, checking and updating the phpMyAdmin software version, and cleaning up unnecessary configuration files. It particularly urged minimising personal data database access privileges for web service accounts.

It recommended checking for abnormal access such as large-scale queries or exports of personal data databases, and verifying whether PHP software is in use in outsourced development and operations systems, contractors and hosting environments, and taking steps as needed.

Yang Cheong-sam (양청삼), secretary general of the commission, said the vulnerability could go beyond compromise of a website itself and lead to large-scale damage, including leakage of many users' personal information stored in connected databases. He said organisations should take special care to prevent leaks of people's personal information by strengthening management systems, including security updates and checks for suspicious access.