Emergency civil-military-government cybersecurity meeting chaired by third deputy national security adviser

'Arbitrary code execution risk' prompts upgrade from 'Attention' to 'Caution'

A view of Cheong Wa Dae. [Yonhap]
A view of Cheong Wa Dae. [Yonhap]

Cheong Wa Dae's National Security Office convened an emergency civil-military-government cybersecurity meeting Thursday and raised the civilian cyber crisis alert level after a critical vulnerability was publicly disclosed in PHP, a programming language widely used in website development.

The National Security Office held the emergency "Civil-Military-Government Cybersecurity Meeting" under Third Deputy National Security Adviser Song Ki-ho, reviewing each sector's response to the recently disclosed PHP vulnerability.

The meeting was called to coordinate each agency's response to the cyber threat. Director-level officials from the Ministry of Science and ICT, South Korea's Ministry of National Defense and the National Intelligence Service — the three agencies responsible for managing cyber crises across the civilian, military and government sectors — attended.

The vulnerability, found in PHP, which is widely used in websites around the world, is considered highly dangerous because it allows attackers to execute arbitrary code without authentication. The PHP Foundation released a security update Wednesday in response. Overseas, some government agencies have temporarily suspended website operations as a precaution. South Korea raised its civilian cyber crisis alert from "Attention" to "Caution" to address the threat. Public institutions and the military are considered relatively safe, as PHP usage in those sectors is low.

The meeting reviewed PHP usage and response measures across the public, private and defense sectors. Participants also discussed rapid deployment of the security update, temporary protective measures for websites unable to install the patch immediately, and checks for signs of compromise. Attending agencies agreed to share threat intelligence and response updates in real time and to maintain close coordination going forward.

"This vulnerability allows an attacker to take control of a server without authentication, and attack attempts have already been reported overseas — how quickly we act will determine the scale of the damage," Song said. He added that the civil, government and military sectors should "work as one team to complete the necessary measures swiftly."

The National Security Office said it will continue to monitor the situation with relevant agencies and review additional measures as circumstances develop.


sunpine@heraldcorp.com