“임시 조치도 어렵다면 서비스 중단하라” KISA, ‘PHP2Shell’ 기업 대응수칙 배포 < IT일반 < IT·과학 < 기사본문 - 주간한국

“임시 조치도 어렵다면 서비스 중단하라” KISA, ‘PHP2Shell’ 기업 대응수칙 배포 < IT일반 < IT·과학 < 기사본문 - 주간한국

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page kr/news/weekly-hankooki/news-articleview-html, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

Weekly Hankook (Korea, Korean), 22 October, by Kang Min-hye: KISA has issued corporate response rules for PHP2Shell. It says KISA urges updating to the latest version, interim security measures where an immediate update is hard (limit request sizes and block unneeded file-upload requests through a WAF or web server), and, if those are also hard, blocking external access or suspending the service until updated; first check PHP use and version across homepages and systems, including outsourced, long-unmanaged, event or test sites and admin pages, restart the web service after updating, check logs since 20 October for abnormally large requests, repeated server errors, calls to command-execution programs and new or changed PHP files, rotate database passwords, API keys and admin passwords on internet-exposed servers, and, if compromise is found, cut external access before restarting, preserve evidence and report to KISA's incident desk. It also says the NSA and FBI advised taking sites offline if they cannot be updated at once.

> KISA는 최신 버전으로 업데이트하고, 즉시 업데이트가 어려운 경우 임시 보안조치를 적용할 것을 권고했다.

_Curator's translation:_ "KISA recommended updating to the latest version and, where an immediate update is difficult, applying interim security measures."

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Weekly Hankook: KISA issued PHP2Shell response guidelines for companies. Update; if not possible, apply temporary measures (request size limits, block unneeded uploads); if even that is impossible, block external access or suspend service. Check logs since the leak on the 20th, rotate credentials, and report incidents to KISA. Also notes the NSA and FBI offline advice and Japan's request.

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "“임시 조치도 어렵다면 서비스 중단하라” KISA, ‘PHP2Shell’ 기업 대응수칙 배포 < IT일반 < IT·과학 < 기사본문 - 주간한국". Selected mechanically, not read by a person.

Capture notes

Language ko. Nothing in the page addresses an AI or hides text from a reader.