[Editorial] The repair gap

The government can announce a cyber threat in seconds. It may take days to find out whether anyone has fixed it. South Korea’s latest cyber incidents illustrate the gap between detecting a software weakness and confirming that the systems affected have been repaired.

On Thursday, the government raised its private-sector cyber alert from “interest” to “caution,” the second-lowest level in its four-tier system, after two serious vulnerabilities were disclosed in PHP, a programming language widely used for websites and online services.

The flaws could let remote attackers run code on affected servers. The alert was justified, but it left a more consequential question unanswered: How many operators could install the fixes, and how many authorities could confirm completion?

PHP is only part of the picture. Police say an artificial intelligence-assisted hacking operation targeted more than 90 domestic companies and allegedly stole 8.2 million records containing personal information.

The PHP vulnerabilities and the alleged intrusion campaign are separate cases, yet both show how automation can turn a software weakness into a large-scale breach. AI helps researchers examine code for defects; attackers can use similar tools to locate vulnerable systems with less technical expertise than such work once required.

The interval between disclosure and exploitation is shrinking. Once a flaw becomes public, attackers can study its details and work backward from a patch before every operator has installed it.

Large organizations may employ teams capable of auditing systems and applying updates promptly. A small clinic or online shop whose website was built years ago by an outside contractor may have no comparable capacity. An update could disrupt the service on which its business depends.

Digital expansion has often outpaced upkeep. Organizations have added online services without maintaining a reliable record of the software they use or assigning clear responsibility for it. Some older versions no longer receive security updates. Outsourcing can blur responsibility further: A hosting provider may maintain the server while the client remains responsible for an outdated application.

Government oversight is also incomplete. During a parliamentary audit, the Korea Internet and Security Agency said it could not determine how widely vulnerable PHP versions remained in use at public institutions or whether all fixes had been installed. The agency also cited limits on its authority to inspect systems directly.

That leaves officials able to issue instructions without confirming compliance. Because responsibility is split among agencies and sectors, no single body has a complete view of the systems that remain exposed.

Policy should make remediation traceable. Authorities need an up-to-date inventory of software running on critical services, alongside clear responsibility for applying and confirming each fix.

When an update is unavailable or a system cannot be repaired promptly, operators need alternatives, such as isolating the vulnerable service until it is secured.

Public agencies and private security firms need a reliable channel for sharing threat intelligence, with responsibility for acting on it clearly assigned.

Smaller businesses need practical assistance to meet these demands. Government support should help pay for security assessments and obsolete-system replacement, including the technical expertise needed to carry out the work.

Companies holding large volumes of personal information should face penalties for persistent security neglect. Incentives should reward sustained investment in maintenance and timely updates.

AI can improve detection, but it cannot establish who must act or ensure that anyone does. Every alert should identify who is responsible and require independent confirmation that the repair is complete.

Korea should judge its cyber defenses by the interval between warning and verified repair. As AI shortens the time needed to find and exploit software flaws, the government’s central task is to ensure that alerts lead to fixes and that the fixes are confirmed.