Personal Information Protection Commission

Press Release

The PIPC Urges Organizations to Take Preventive Measures Against Personal Data Breaches Arising from PHP2Shell

- The PIPC calls for immediate safeguarding measures, including PHP security patch updates and stronger access controls for database management tools 

- Organizations are urged to strengthen security management, including checks for suspicious database access attempts involving large-scale queries and data exfiltration

October 22, 2026

(This is an unofficial translation of a press release, originally prepared in Korean.)

The Personal Information Protection Commission (PIPC) calls for data controllers in the public and private sectors to take privacy-safeguarding measures in response to PHP2Shell, a recently discovered vulnerability.

PHP2Shell is a pair of vulnerabilities that could allow malicious actors to exploit safety flaws in PHP versions, enabling remote code execution on the website host. The vulnerabilities were publicly announced on 21 October 2026. The Ministry of Science and ICT (MSIT) and the Korea Internet & Security Agency (KISA) have issued guidance on measures to address such vulnerabilities.

PHP (Hypertext Preprocessor) is a popular programming language on which many websites and web applications are built. When exploited, it may lead to threats to web servers and data leaks of personal information stored in connected databases. 

In particular, if phpMyAdmin, a PHP-based DB management tool, is exposed outside organizations or granted excessive database access authority, attackers could exploit these vulnerabilities to gain unauthorized access to large amounts of personal information, underscoring the need for urgency. 

Against this backdrop, the PIPC calls for data controllers operating web services to implement the following measures promptly in response to PHP2Shell.

Four Measures for Organizations to Take Promptly 

● Emergency measures to address vulnerabilities 

- Checking the PHP versions 

- Deployment of latest security patches

- Removing unnecessary web services

● Stronger access controls to databases

- Restricting DB management tools, including phpMyAdmin, to access the Internet directly 

- Updating phpMyAdmin software after checking the version 

- Opting out unnecessary default settings

- Minimizing access authority granted to web service accounts for databases containing personal information

● Prevention of large-scale data leaks and exfiltration 

- Overhauling anomalies in database access attempts, including large-scale DB queries and data exfiltration 

- Stronger access log management, including anomaly detection and blocking

● Identifying and Addressing Data Security Gaps 

- Checking whether PHP software is used in outsourced development and management systems, systems managed by entrusted service providers, and hosting environments, and taking appropriate measures

PIPC Secretary General Cheongsam Yang said, "The vulnerability could lead to a large-scale incident, extending beyond the compromise of websites themselves to the breach of personal information belonging to numerous users stored in connected databases."

He added, "Organizations should exercise particular caution to prevent personal data breaches by promptly updating security patches and strengthening security management practices, including monitoring for suspicious access attempts."

* A PDF file, formatted for better readability, is attached.