"Check Your Company Website First"…TIPA Issues Emergency PHP Vulnerability Guidance to SMEs

Domestic response to the global PHP security flaw, the so-called 'PHP2Shell' incident, is spreading to the small and medium-sized enterprise (SME) level. The Small and Medium Business Technology Information Promotion Agency (TIPA) under the Ministry of SMEs and Startups sent a newsletter titled "PHP Security Vulnerability-Related Security Guidelines" to member SMEs on the 23rd. According to this publication, the email was delivered to corporate representatives that afternoon.

The background for this guidance is two PHP remote code execution vulnerabilities (CVE-2026-109618, 109619) with patches released on the 21st. These are holes in the PHP programming language engine itself, used by approximately 7 out of every 10 websites, affecting virtually all versions released over the past decade. Actual attack attempts were observed even before the patch was released, and the Korea Internet & Security Agency (KISA) announced corporate response guidelines through its Bohonaara portal on the 22nd.

The reason government agencies specifically targeted SMEs for guidance is clear. In South Korea, PHP is widely deployed in domestic homepage creation tools such as Gnus Board and Rhymix, WordPress-based corporate homepages, and small shopping malls. AhnLab counted approximately 110,000 vulnerable PHP assets exposed to the internet domestically (pre-patch estimate), with a significant portion being SME websites lacking dedicated security personnel. KISA warned that successful attacks could enable "installation of remote control files (webshells), customer information leaks, homepage manipulation, and internal network intrusion."

The response guidelines consist of four key steps. First, check whether PHP is used and identify the version in your company website and internal systems, then update to the patched versions (8.5.12, 8.4.27, 8.3.36, 8.2.35) and ensure the service is restarted. KISA emphasized that "if not restarted, the previous version remaining in memory continues to operate, leaving the system still vulnerable." Versions PHP 8.1 and below, which are no longer supported, must be switched to supported versions, and if immediate updates are difficult, temporary mitigation measures such as disabling file upload functions should be applied.

Major hosting companies such as Cafe24 and Gabia have announced they have completed server patches. The blind spot ultimately lies with sites operating on self-managed servers outside of hosting providers or sites that were created but remain unmanaged. Security industry officials agreed that "what needs to be checked now is not some elaborate security solution but the PHP version of our company website." Suwon Ilbo previously reported a chronological summary of the full details of this incident.