"Check Your Company Website First"...TIPA Issues Emergency Advisory on PHP Vulnerability to SMEs

The PHP security vulnerability that shook the global web, dubbed the 'PHP2Shell' incident, is now spreading to small and medium-sized enterprises (SMEs) domestically. On the 23rd, the Small and Medium Business Technology Information Promotion Agency (TIPA) under the Ministry of SMEs and Startups sent a mass newsletter titled 'Security Guidelines Regarding PHP Security Vulnerabilities' to member SMEs. According to this publication's confirmation, the email was delivered to corporate representatives on that afternoon.

The background for the advisory is two PHP remote code execution vulnerabilities (CVE-2026-109618·109619) whose patches were released on the 21st. These are holes that penetrate the engine itself of PHP, the programming language used by approximately 7 out of every 10 websites, affecting virtually all versions released over the past decade. Actual attack attempts were observed even before the patch was released, and the Korea Internet & Security Agency (KISA) announced corporate response guidelines through Boho-Nara on the 22nd.

The reason government agencies specifically stepped forward to advise SMEs is clear. In Korea, PHP is widely deployed in domestic website creation tools like Gnuboard and Rhymix, WordPress-based corporate websites, and small shopping malls. AhnLab tallied approximately 110,000 vulnerable PHP assets exposed on the internet domestically (estimated pre-patch), with a significant portion being SME sites lacking dedicated security personnel. KISA warned that successful attacks could enable "installation of remote control files (web shells), customer information leaks, website tampering, and even internal network penetration."

The response guidelines have four key components. First, companies must check whether their website and internal systems use PHP and verify the version, then update to patched versions (8.5.12, 8.4.27, 8.3.36, 8.2.35) and absolutely restart the service. KISA emphasized that "if the service is not restarted, the previous version remaining in memory will continue running, leaving the system still vulnerable." PHP versions 8.1 and below, which no longer receive support, must be upgraded to supported versions, and if immediate updates are difficult, temporary mitigation measures such as disabling upload functions should be applied.

Major hosting companies such as Cafe24 and Gabia have announced that they have completed server patches. As a result, the blind spots are websites operated on independent servers outside of hosting services, or abandoned and unmanaged sites. Security industry officials agree that "what needs to be checked now is not some elaborate security solution, but the PHP version of your company's website." News S previously reported a timeline of the full scope of this incident.