Signs Suggest Hackers Took Over 25 Servers by Exploiting PHP Flaw; South Korea Also Targeted

What happened

Security researchers at Dream Research, the team of Israeli cybersecurity company Dream, reported a cyberattack that used a PHP flaw. The attackers first scanned about 19,000 firewalls around the world. Then they picked 240 devices in four countries, including South Korea, as targets. In some cases, they got into internal management servers too.

Key numbers

• About 19,000 firewalls were scanned on June 23 and 24.
• 240 firewalls in South Korea, the US, Japan, and Taiwan were chosen as targets.
• Attackers gained root (top-level administrator) access to 24 firewalls.
• In the US government-linked group, 2 firewalls and 1 internal management server were taken over.
• On 22 of the 24 hacked firewalls, attackers left web shells behind for later use.

Key terms explained

The attackers chained together two flaws. The first was a PHP bug called 'PHP2Shell' that lets someone run commands on a server remotely. The second was a Linux flaw that lets a normal user gain full control. A web shell is a hidden program that lets attackers control a system from afar. It can be used for later attacks.

Why it matters

This attack hit government-linked systems and firewalls, which are meant to protect networks. If attackers control a firewall, they may reach other systems behind it. The researchers found signs of links to China and use of AI tools. However, they said they could not prove a Chinese hacking group was behind it, or that AI wrote the attack code. Officials say no damage from this PHP flaw has been reported yet in Korea, but they are urging companies to install security updates.

What to watch

• Whether Korean firewalls were really breached and how much sensitive data was leaked is still unknown.
• Whether companies install the PHP security update quickly.
• Whether more hacked systems or web shells are found.
• Whether investigators confirm who was behind the attack.