About 25,000 servers in South Korea are running outdated, unpatched versions of PHP — a programming language used by 75 percent of websites worldwide — after a security flaw was discovered in the software. [123RF]
About 25,000 servers in South Korea are running outdated, unpatched versions of PHP — a programming language used by 75 percent of websites worldwide — after a security flaw was discovered in the software. [123RF]

A flaw has been discovered in the programming language PHP that allows outsiders to seize control of a website or app server without logging in. An analysis has found that 24,591 servers in South Korea are running vulnerable versions of the software with no security patch applied.

French cybersecurity firm Cybelangel, in an analysis published Wednesday (local time), said that based on data from security search engine Shodan as of Tuesday, about 2.24 million servers worldwide are exposing PHP to the internet. Of those, about 1.5 million had their version information confirmed. More than half — 883,717, or 59 percent — of the version-confirmed servers were running end-of-life versions for which no fixes are issued. Running an end-of-life version makes it effectively impossible to apply security patches against known vulnerabilities, leaving servers fully exposed to attack. Cybelangel said the actual scale of risk could be even larger, as roughly 740,000 additional servers had their version information hidden and were excluded from the count.

Breaking down vulnerable PHP-based servers by country, South Korea had 24,591 internet-connected servers running PHP 8.1 or earlier — versions for which update support has ended. That figure represents 82 percent of all domestic PHP servers whose versions could be confirmed.

Among the top 10 countries by PHP usage covered in the analysis, South Korea had the second-highest share of servers running outdated versions, behind only Algeria at 100 percent. China followed at 75 percent, Hong Kong at 70 percent and Japan at 61 percent.

By total number of vulnerable servers, South Korea ranked eighth, behind the United States (228,770), China (67,306) and Japan (55,460), among others. As of the time the PHP security risk became public, no domestic cases of exploitation had been confirmed.

By hosting provider, PHP servers were concentrated at a handful of companies — 293,480 at Amazon, 142,401 at Hostinger and 81,078 at Alibaba Cloud. Cybelangel said the concentration underscores the importance of patching at the provider level.

The figures represent server counts, not website counts. Servers that concealed their version information were excluded from the tallies. The counts are also Cybelangel's own estimates and may differ from figures compiled by other organizations.


kate01@heraldcorp.com