KR — 전자신문
Creinity Responds to PHP Security Vulnerabilities, Highlights Java-Based Email Security Technology
Security1 min read
Korean email security firm Crinity says its SpamBreaker product is not affected by two newly disclosed PHP security flaws, because it does not use PHP. The company is using the case to stress how important safe software design and ongoing updates are.
What happened
On the 21st, two security flaws in PHP, a popular programming language for websites, were made public. The flaws let an attacker run code on a server without logging in. Crinity said its email security product, SpamBreaker, is built mainly on Java and does not include a PHP runtime. So the company says the PHP flaws do not directly affect it.
Key facts
- Two PHP flaws were disclosed on the 21st.
- The flaws allow remote code execution without authentication.
- SpamBreaker uses a Java-based structure in its mail engine and admin console.
- SpamBreaker checks email in three layers: packet-based, authentication-based, and content-based.
Background
Email security products often use many outside software parts, called libraries. If one part has a weakness, the whole system can be at risk. The Korea Internet & Security Agency (KISA) advised users to check which PHP versions they run and to install the latest security patches.
Why it matters
The story shows that a security tool must be safe itself, not only good at catching attacks. Buyers should check how a product is built and how often its parts get security updates. Crinity says it also wants customers to look at outside libraries and update support.
What to watch
- Whether companies using PHP apply the official security patches.
- Whether Crinity shares more detail on how it manages outside libraries and updates.
- How customers judge email security tools on product safety, not just attack blocking.
Glossary
- PHP
- A programming language often used to build websites and web services.
- SpamBreaker
- Crinity's email security product that blocks spam and harmful emails.
- Java
- A widely used programming language that SpamBreaker's main parts are built on.
- KISA
- Korea Internet & Security Agency, a government group that works on internet security.