The Personal Information Protection Commission (PIPC) of South Korea has called on data controllers to take preventive measures following the discovery of a critical security vulnerability in PHP software.

The vulnerability, named "PHP2Shell" and disclosed on October 21, allows an attacker to execute malicious commands on a web server without authentication, creating a risk of personal data leaks from connected databases (DB). The PIPC warns of the particular danger posed by database management tools such as "phpMyAdmin" when exposed on the internet or granted extensive access rights. The authority therefore urged organizations to urgently apply security patches, remove unnecessary web services, and strengthen access control to databases. It is also recommended to limit direct internet access for administration tools, minimize service account privileges, monitor any abnormal activity such as mass data extraction, and audit systems managed by third parties.