An artificial intelligence-driven public-interest security project has conducted a comprehensive analysis of South Korea's e-Government standard software, uncovering 990 security vulnerabilities. The initiative is now moving beyond mere detection toward establishing a full-fledged public-private collaboration framework that connects actual security patching with supply chain propagation.
On the 14th, Project Canopy—the public-interest AI security initiative under the incorporated association Project Plasma—released its first analysis results. The initial target was the common components of the e-Government Standard Framework (eGovFrame), which is extensively used across government agencies, public institutions, and system integration (SI) projects in South Korea.
Project Canopy deployed an AI-based automated analysis engine to conduct an initial sweep, flagging approximately 1,300 vulnerability candidates. An advanced refinement system then rigorously filtered out duplicates and false positives, ultimately identifying 990 structural defects and security vulnerabilities. Of these, 10% were classified as "Critical" or "High" severity, requiring immediate remediation.
Key vulnerabilities included authentication bypasses allowing login to arbitrary accounts without a password, arbitrary SQL execution enabling regular users to manipulate databases with server-level privileges, file exfiltration due to exposed static encryption keys, and Insecure Direct Object References (IDOR/BOLA) that could lead to privilege escalation attacks.
Project Canopy also highlighted structural weaknesses in the eGovFrame's architecture. The framework is not designed to be updated with a simple one-line declaration like an external library; instead, it operates in a "template format" where source code is copied and pasted for use. This design makes it highly susceptible to "patch isolation," where security patches fail to propagate properly to frontline operating systems and remain neglected for extended periods. Given that the framework's duplicated code is widely distributed across countless subsystems, a single internal vulnerability could directly translate into a systemic threat spanning South Korea's public and private services.
The project emphasized that the figures released represent "refined data"—not raw output generated by a large language model (LLM), but results meticulously filtered for false positives through its proprietary analysis engine. This means the AI automatically identified exploitable vulnerability candidates from an enormous codebase that would take humans months to manually review.
Park Se-jun, Chairman of Project Canopy, stated, "Companies and institutions operating systems based on the e-Government Standard Framework must reference these analysis results and take immediate security measures." He added, "We will move beyond vulnerability detection to build a secure ecosystem across the entire public software supply chain."
Going forward, Project Canopy plans to focus not only on detection but also on building a collaboration platform for triage and patch propagation. Approximately 300 security patches have been completed to date. Beyond the eGovFrame, the project intends to regularly analyze major domestic and international open-source software. Officially launched on June 17, the project currently counts 36 companies and institutions as partners, who receive preemptive access to remaining vulnerability information and specific patch details.
Once added, BigGo Finance appears first in Google Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.
Follow the three steps to link a messaging app like Telegram or LINE, and get schedule notifications pushed to you automatically
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
