Abstract:
The global emergency repair operation for critical PHP vulnerabilities has entered its second day, and the situation continues to be tense. Researchers warn that before and after the vulnerability was publicly disclosed, hacker attack attempts have jumped from thousands to millions, and the possibility that some systems have been compromised cannot be ruled out. On Thursday, the UK confirmed that more than 30 government services remained offline pending the deployment of security updates. Telecom operator Orange also announced on Thursday that it would suspend access to some websites and applications.
The day before, dozens of countries and regions including Austria, the Netherlands, Finland, and France have successively adopted similar measures, and many Japanese banks and airlines have also interrupted some online services.
Matthew Prince, CEO of cybersecurity company Cloudflare, revealed that his system had identified thousands of attempts to exploit the vulnerability 10 hours before it was publicly disclosed; within two hours of the announcement, the number of attacks soared to hundreds of thousands, and then further increased to millions. It's unclear how many intrusion attempts resulted in successful attempts to steal data or compromise systems.
Palo Alto Networks stated that it has identified more than 22.6 million "exposed instances" containing the vulnerability, and the scale is "extremely large."
On Thursday, the Ministry of Industry and Information Technology's Cybersecurity Threat and Vulnerability Information Sharing Platform issued an emergency reminder that PHP has two extremely critical remote code execution vulnerabilities. Attackers can directly invade the target system without any authentication. Relevant units and users are recommended to immediately investigate and upgrade to the latest security version.
The vulnerability was targeted before it was made public
According to Amazon researchers, hackers were trying to exploit the vulnerability before it was made public. Amazon's Threat Intelligence said in its report released on Wednesday that an unidentified "threat actor" had somehow obtained information about the vulnerability before details were made public and launched an attack on Amazon's sensor network used to track cybercriminal activity. The company has since detected multiple other exploitation attempts.
Matt Hull, vice president of cyber intelligence and response at NCC Group, said that the window period between the vulnerability being known and the patch being deployed is critical, requiring affected organizations to act quickly. "There is a real possibility that a vulnerable system has been compromised, including a backdoor," he said. "The potential impact cannot be underestimated."
Currently, the Office of the National Cyber Director of the United States is coordinating the FBI, the Cybersecurity and Infrastructure Security Agency, the National Security Agency and other agencies to jointly respond to this incident.
The scope of influence covers 70% of the global Internet
PHP is one of the most widely deployed technologies on the Internet, supporting the operation of millions of websites and driving up to 70% of the world's Internet infrastructure.
Mainstream content management systems such as WordPress, Drupal, Joomla and Magento all use PHP as the underlying support. Network security company Huntress pointed out that PHP is also widely "hidden" in various software, even if the relevant software does not declare the use of PHP.
Once any such basic vulnerability is exploited, it may have a chain effect in the Internet software supply chain, exposing online services to risks such as data theft, malware implantation, and system leakage.
Temporarily taking a website offline is a common defensive method to prevent attackers from exploiting vulnerabilities during patch deployment. The PHP development team released the software update on Wednesday and urged users to adopt it immediately.
AI tools help vulnerability discovery and repair
The vulnerability was discovered by Wiz, a cybersecurity company owned by Alphabet, with the help of multiple artificial intelligence tools.
Wiz said in the report that it collaborated with OpenAI and cybersecurity company Calif to complete the research work, and estimated that the vulnerability had existed unnoticed for more than ten years.
"With cutting-edge AI models and the right tools, a researcher can accomplish in a week what previously took a world-class team months," Wiz wrote in the report.
The company stated that AI tools not only helped quickly identify vulnerabilities, but also accelerated the formation of repair plans, playing a key role in this emergency response.
Comments