Guidance covers PHP security patches, database access controls

Watchdog calls for stronger oversight of personal data access and export

[Provided by the Personal Information Protection Commission]
[Provided by the Personal Information Protection Commission]

The Personal Information Protection Commission has urged public institutions and businesses to take preventive measures against personal data breaches linked to a PHP security vulnerability. The Ministry of Science and ICT and the Korea Internet & Security Agency had earlier issued their own guidance on the flaw.

The commission said Thursday it had called on personal data processors — including public institutions and private companies — to strengthen data protection in connection with a vulnerability known as "PHP2Shell," which was publicly disclosed Wednesday and allows attackers to execute malicious commands on web servers without separate login or authentication.

PHP is software widely used in the development and operation of web services. If exploited, the vulnerability could lead not only to web server breaches but also to the exposure of personal information stored in connected databases.

The risk is particularly acute when database management tools built on PHP — such as phpMyAdmin — are exposed to the internet or granted excessive database access privileges, as attackers could exploit such conditions to access large volumes of personal data.

In response, the commission issued guidance covering four areas: emergency patching of the vulnerability, strengthening database access controls, preventing large-scale data leaks, and inspecting blind spots in system management.

On emergency patching, the commission advised organizations to check the version of any PHP-based systems in use, apply the latest security patches and remove unnecessary web services.

For database access controls, the guidance calls for restricting direct internet access to database management tools such as phpMyAdmin, verifying and updating the phpMyAdmin software version, and removing unnecessary configuration files. The commission particularly recommended minimizing the database access privileges granted to web service accounts. On preventing large-scale leaks, organizations should check for abnormal access — including bulk queries or exports of personal data — and strengthen anomaly detection, blocking and access log management. The blind-spot inspection covers verifying whether PHP software is in use in outsourced development or operations systems, subcontractor environments and hosting setups, and taking appropriate action.

"This vulnerability poses a risk that goes beyond a breach of the website itself — it could lead to large-scale damage, including the exposure of personal information stored in connected databases," said Yang Cheong-sam, secretary general of the commission. "Organizations must reinforce their management systems, including applying security updates and checking for suspicious access."


ko@heraldcorp.com