US, Japan, South Korea, and Taiwan Warned Over PHP Vulnerability Router Attacks

Following reports that a total of 25 firewalls and networking devices in the United States, Japan, South Korea, and Taiwan were allegedly compromised due to PHP-related vulnerabilities, the Ministry of Digital Affairs' Administration for Cyber Security (ACS) issued an advisory in Taipei today, urging businesses and organizations to review their network equipment configurations and apply security updates as soon as possible. The incident came to light through intelligence provided by an Israeli cybersecurity firm, which indicated that attackers exploited known PHP vulnerabilities to remotely compromise certain devices. Although the management interfaces of most of these devices are not exposed to the public internet, the risk remains significant if they are exposed and left unpatched.

At the core of this vulnerability event is PHP, a scripting language widely used in the management interfaces of many networking devices. When management interfaces are accessible externally, attackers can use automated scripts to rapidly scan and exploit the vulnerabilities to execute unauthorized commands. While the ACS made a preliminary assessment that it would be difficult for attackers to simultaneously conduct batch attacks against multiple devices of different versions—due to significant variations in PHP versions and configurations across devices—this does not mean the risk has been eliminated. If device management interfaces are not properly restricted, they can still be exploited by bad actors.

To mitigate such risks, the ACS recommends that enterprises ensure management interfaces are placed within internal networks or accessed via VPN tunnels during device deployment, and regularly check whether official security patches have been installed. In addition, organizations should enable multi-factor authentication, restrict the source IP addresses permitted to log into management accounts, and monitor login activities on management interfaces. If abnormal logins or command executions are detected, incident response procedures should be initiated immediately to prevent potential data breaches or the loss of system control.

This incident also highlights the vulnerability of the global supply chain. The networking devices in the United States, Japan, South Korea, and Taiwan are manufactured by different vendors, yet the majority of these devices were designed with PHP as the default back-end processing program. When vulnerabilities are disclosed, attackers can rapidly leverage the same codebase to launch simultaneous attacks across multiple countries, creating cross-border cybersecurity threats. This is not merely an issue for individual enterprises, but a national-level challenge in cyber defense, prompting a call for government agencies and industries to strengthen collaboration and establish more robust vulnerability reporting and patching mechanisms.

Finally, the ACS reminded enterprises that beyond applying patches in a timely manner, they should also enhance employee cybersecurity education to raise awareness of cyberattack methods. Through regular security testing and drills, organizations can effectively reduce security incidents caused by configuration oversights or human error. Only through a tripartite defense combining hardware, firmware, and personnel can organizations truly withstand the increasingly sophisticated cyberthreats that may arise in the future.