A cyber crisis alert has been raised over a security vulnerability in PHP, a programming language widely used on websites worldwide, and South Korea's Ministry of Science and ICT plans to draw up cross-government security measures.

Deputy Prime Minister and Science and ICT Minister Bae Kyung-hoon (배경훈) said at a comprehensive parliamentary audit by the National Assembly's Science, ICT, Broadcasting and Communications Committee on Thursday that the government also views cyber security issues seriously. He said broader countermeasures are needed beyond PHP.

PHP is used to build various web services such as websites, online shopping malls and bulletin boards. The situation emerged after 2 serious security vulnerabilities in PHP were disclosed.

The vulnerabilities allow attackers to execute malicious commands on servers over the internet without a separate login procedure. If an attack succeeds, damage could expand to include remote server control through webshell installation, personal data leaks, and website tampering or disruption.

The ministry and the Korea Internet & Security Agency (KISA) recommended that companies and institutions in South Korea apply PHP security updates immediately. At noon the same day, the government raised the cyber crisis alert for the private sector to “Caution” from “Attention” to pre-empt the possibility of large-scale hacking.

During the audit, ruling People Power Party lawmaker Seo Cheon-ho (서천호) asked when the government became aware of the risk of the vulnerabilities, noting PHP is widely used by domestic websites. Bae said the government quickly recognized the situation shortly after the notice from the PHP-related foundation was issued.

Choi Woo-hyuk (최우혁), head of the Information Protection and Network Policy Office at the ministry, said the ministry confirmed the details related to the vulnerabilities at around 11 p.m. on Oct. 21 and issued a guidance notice at 11:20 p.m. He said it instructed operators to apply security patches and to run systems offline if patching is difficult.

The ministry also asked corporate chief information security officers to take response and update steps. Choi said a meeting led by the National Security Office was also held the previous day with participants from the private sector, government and the military.

Democratic Party lawmaker Han Jun-ho (한준호) questioned KISA President Lee Sang-joong (이상중) about the status of the response to the PHP vulnerabilities, including whether security patches were applied.

Lee said public administrative agencies do not appear to use PHP much, but he said KISA has yet to identify the security patch status of domestic institutions and companies. He also said current rules make it difficult for KISA to directly monitor and inspect individual systems.

Han asked whether there are institutional limits to KISA's response and urged it to put in place necessary security measures. He also requested that the lawmaker’s office be briefed on related matters even after the audit.

Bae said the government is preparing a cross-government response plan beyond the National Security Office-level control tower. He said he would also report the cross-government response plan to the National Assembly.