Cybersecurity companies said websites worldwide faced millions of attempts to exploit a newly discovered vulnerability in PHP. The programming language supports about 70% of websites worldwide. The problem emerged on Wednesday, prompting governments and companies to take websites offline to prevent attacks and install a patch. Many government websites returned shortly after administrators installed the patch.
The website for the BBC's Traitors was unavailable on Thursday. The vulnerability raised particular concerns for schools, local governments and charities, which may lack dedicated cybersecurity staff to implement the fix. Ciaran Martin, former chief executive of the UK's National Cyber Security Centre, called the flaw the most serious vulnerability found in five years. Martin said most vulnerabilities in internet software were unimportant. However, Ryan Austin, a researcher at cybersecurity company Calif who helped discover the flaw, said exploitation did not yet appear to have become widespread.
Cloudflare chief executive Matthew Prince described the company's observations in an update spanning Wednesday night and Thursday. Prince said Cloudflare detected tens of thousands of exploitation attempts during the first 45 minutes after the announcement. Prince said the count reached hundreds of thousands within two hours. Prince said the count had subsequently reached millions. Amazon Threat Intelligence said attackers were already widely exploiting the vulnerability, known as PHP2Shell. Amazon Threat Intelligence said several actors tested ways to exploit the vulnerability before PHP developers released the fix on Wednesday. Cloudflare said the company detected thousands of exploitation attempts during the 10 hours preceding public disclosure. Cybersecurity expert Professor Alan Woodward said disclosure preceded the patch by a day, raising concerns about how the alert was handled.
Internet infrastructure expert Michal Wozniak said the vulnerability could let hostile actors take over resources belonging to exposed websites. Websites such as Slack and Wikipedia have access to computing capacity, servers and IP addresses that identify the websites online. PHP manages and mediates this infrastructure in many cases. Criminal groups, state-sponsored hackers and cryptocurrency miners could establish a presence in vulnerable websites and use the websites' resources for other purposes. Hackers could launch attacks through a compromised website's IP address to conceal the hackers' origin. Cryptocurrency miners could use compromised servers to perform energy-intensive calculations without paying for the computing power. Wozniak said the scale of such activity remained unclear. Wozniak said many affected websites would not know about the activity.
Wiz, a research organization involved in discovering the vulnerabilities, said the problem was arguably among the gravest software vulnerabilities ever identified. Wiz said the underlying flaws had existed for decades. Wiz said proving the flaws could be exploited required an exceptionally complicated sequence near the limits of human researchers' practical capabilities. Wiz said frontier AI models greatly lowered that difficulty and made exploitation possible.
The US National Security Agency warned that the flaw could let attackers control web servers, steal sensitive information, interrupt services and penetrate further into networks. The NSA said cyber actors were likely to turn PHP2Shell into an attack tool. The NSA said the risks required US government departments and agencies to install patches immediately. South Korea's government said on Thursday that the government was activating emergency response measures. South Korea's government said the government was raising the cybersecurity alert level for the private sector. South Korea's government said the government was providing repair guidance to tens of thousands of companies. China's industry ministry urged organizations to inspect systems immediately and install the latest secure PHP version. China's industry ministry also recommended stronger cybersecurity monitoring and changes to passwords and keys. Japan's prime minister urged businesses and organizations to install the patch or take websites offline.
Global Websites Targeted in PHP Vulnerability Exploitation Attempts
FLASH AIShare
Summary
CFT concerns have risen as global websites face PHP2Shell exploitation attempts. Cybersecurity firms reported millions of attacks, with Cloudflare tracking tens of thousands in 45 minutes. The US NSA warned of server control and data theft risks, urging immediate action. South Korea, China, and Japan have issued emergency measures. MiCA compliance may soon require stricter security protocols for crypto platforms. Amazon and others observed pre-patch testing by attackers.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.