NIS "Considering Halting Operations of Public PHP Systems"...Blind Spots in Local Governments

The National Intelligence Service (NIS) has begun reviewing extreme measures, including recommending a temporary suspension of operations for public systems exposed to the 'PHP2Shell' vulnerability. According to reports, on the 27th, the NIS stated, "We are reviewing whether to implement recommended measures such as temporary suspension of operations in comprehensive consideration of the threat situation." The NIS previously distributed an emergency security advisory to national and public institutions on the 22nd and has been intensively monitoring attempted attacks on the public information network.

The mention of "operational suspension" stems from deteriorating circumstances. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two PHP vulnerabilities to the 'Known Exploited Vulnerabilities (KEV)' list on the 26th (local time), mandating that federal agencies take action by the 29th. In particular, the advisory included the recommendation: "If patching is impossible, convert the system to offline." The security industry also reported that actual remote takeover cases were first confirmed in global observation networks (honeypots). The Dutch government portal and foreign ministries of Finland and Belgium have already actually suspended operations of some systems, while security authorities in Japan and the United Kingdom have issued warnings.

Domestic exposure levels are worse than the global average. Based on the Shodan search engine, 89% of 56,423 domestic PHP servers exposed to the internet are running unsupported older versions (8.1 or below), significantly exceeding the global average of 73.5%. The Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) also advised on the 26th to "consider temporarily suspending website operations depending on circumstances," making the NIS's review an extension of that guidance.

The issue is where the risks are concentrated. According to administrative resources statistics from the Ministry of the Interior and Safety, out of 15,618 public information systems, 1,027 (6.6%) are PHP-based. The proportion among central government agencies is only 2.4%. Thanks to core government systems being built on the Java-based e-government standard framework, the ministry confirmed no PHP usage among 217 major systems inspections, including Gov24, stating that "the impact is limited." However, the same statistics show that 70.7% of public PHP systems are concentrated in local governments and local education authorities, with basic local governments alone accounting for 519 systems. At a parliamentary inspection on the 23rd, the KISA director answered that the status of vulnerable version usage has not yet been identified. While central systems are safe, risks are concentrated in local areas, and even those local areas have not compiled current data.

PHP systems in basic local governments often serve as touchpoints where residents interact daily. These are sites built outside the standard framework, such as library and sports facility reservations, festival announcements, and affiliated agency websites. Smaller institutions without security staff experience delayed patching and become the longest-exposed targets for attackers.

Operational suspension is a last resort requiring acceptance of administrative service disruption. However, now that the United States has adopted "shut it down if you can't patch" as official policy and European governments have actually begun shutting systems down, the only option is to expedite patching. Each local government must conduct a complete survey of whether their systems use PHP and what versions they use before NIS recommendations come down. This publication will continue reporting on developments in this matter.