[DigitalToday reporter Jin-ho Lee (이진호)] The government urged website operators to urgently check and update against PHP security vulnerabilities. It said traces of compromise should be checked and credentials replaced because malware that penetrated earlier may remain even after updating to the latest version.

A 'PHP2Shell security vulnerability FAQ' prepared by the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) on Oct. 26 said three security vulnerabilities allowing remote code execution in PHP were recently identified.

PHP is a programming language widely used to develop websites and web services. The vulnerabilities allow an attacker to execute malicious commands on a server without logging in, which could lead to personal data leaks, website tampering and intrusion into internal networks.

The ministry recommended immediate security updates for two vulnerabilities disclosed on Oct. 21 (CVE-2026-109618 and 109619). For an additional vulnerability disclosed on Oct. 24 (CVE-2026-115560), it said separate security settings should be applied until a security patch is distributed.

The ministry recommended checking server access logs and file change histories from Oct. 20 onward. Key credentials including passwords for internet-connected databases, administrator account passwords and external service integration keys should also be replaced. It said websites built in the past but no longer in use, as well as equipment with PHP installed, should also be checked.

Websites with login functions are not exceptions. Attacks are possible at a stage before authentication procedures, it said. The ministry also recommended measures to prevent PHP version information from being exposed externally through server settings.

Website operators should first check whether PHP is used and confirm the version. If they do not manage it directly, they can ask the website developer or hosting provider about the PHP version and whether security measures are in place. Secure PHP versions listed by KISA are 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or higher.

It said security support for PHP 8.2 is expected to end on Dec. 31 and recommended using version 8.3 or higher. It also said versions PHP 8.1 or lower, for which support has already ended, should be switched to 8.3 or higher.

After security updates, servers or PHP execution processes should be restarted to ensure changes are applied. It said it is desirable to back up data and conduct tests in advance because service disruptions may occur during the update process.

The vulnerability additionally announced on Oct. 24 cannot be resolved with existing security updates alone. For the vulnerability occurring in specific session handling settings, KISA advised applying 'session.upload_progress.enabled=0' and restarting the PHP execution process.

Existing compromise should also be checked. If an attacker installed malicious files such as web shells on the server by exploiting the vulnerabilities, those files are not automatically deleted even if programs are updated. If hacking is suspected, the server should not be shut down immediately. If the server is turned off or restarted, traces of the attack remaining in memory may disappear, making it difficult to determine the scope of damage.

If a website screen has been tampered with or unknown files and accounts are found, operators should block external access to the server and then report a security incident. If a leak of customer information is confirmed, it should also be reported separately to the Personal Information Protection Commission.

The ministry also provides security consulting for small and medium-sized enterprises and small business owners through 16 regional information security support centres nationwide. Free website vulnerability checks and hacking diagnostic tools are available through KISA's BohoNara. If hacking is suspected or a security incident occurs, operators can seek advice by calling 118 without an area code or file a report through BohoNara.