Hackers attempted to exploit security vulnerabilities in the widely used programming language PHP several days before the flaws became public, according to cybersecurity researchers at Amazon.com Inc.
The flaws were revealed on Oct 21 and forced governments and organisations across the world to take websites offline as a precaution as they worked to implement a security update.
PHP contains two vulnerabilities which could potentially expose organisations using it in websites and software platforms to cyberattacks. The developers responsible for maintaining PHP said on Oct 21 they released software updates to patch the flaws, urging users to adopt those changes immediately.
PHP is one of the web’s most widely deployed technologies, underpinning millions of websites. Any weakness could therefore cascade through the Internet’s software supply chain, potentially exposing online services to data theft, malware and breaches. Taking sites offline means attackers can’t reach and exploit a flaw while it’s being fixed.
On Oct. 17, several days before the flaws were public, Amazon’s threat intelligence unit said it identified hackers attempting to exploit a network of "honeypot” sensors it uses to track and analyse cybercrime.
In a report published on Oct 21, Amazon said that the activity was conducted by an unknown "threat actor” who had somehow obtained information about the vulnerabilities prior to the public release of details about them.
Amazon later detected several other exploitation attempts. After the public disclosure, Amazon said the flaws were being "broadly exploited” by hackers, though it did not provide information on any hacking victims.
The window between security holes becoming known and organisations implementing a patch was critical and required swift action by any organisation affected, said Matt Hull, vice president of cyber intelligence and response at NCC Group.
"There is a real possibility that vulnerable systems could already have been compromised, including the creation of backdoors,” said Hull. "The potential impact is serious.”
Telecommunications operator Orange said on Oct 22 that it was suspending access to some of its websites and applications while it deployed security patches for the vulnerabilities, according to a statement.
In Japan, several banks and airlines took services offline. Mizuho Financial Group Inc’s bank and security arms halted services and said they were taking emergency steps to improve security. Regional lender Shizuoka Bank suspended its website and app, while Mitsubishi UFJ Financial Group Inc companies halted some online services.
Elsewhere, governments and organisations in countries including Austria, the Netherlands, Finland, France, Denmark, Australia, Canada, Germany, Belgium and the UK were among those to pull websites offline on Oct 22 as they worked to implement fixes.
The US Office of the National Cyber Director was coordinating with the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, the National Security Agency and others to remediate the issue.
US cybersecurity company Palo Alto Networks said that it had identified more than 22.6 million "exposed instances” – such as a server, database, or application – containing the PHP vulnerabilities. Lee Klarich, Palo Alto’s chief product and technology officer, said the scale of the exposure was ”massive.”
PHP is "everywhere” and quietly powers websites that run using systems such as WordPress, Drupal, Joomla and Magento, according to the cybersecurity firm Huntress. PHP is also present "under the hood” of software, even though the software may not advertise that it is using it, Huntress said.
Researchers at Alphabet Inc-owned cybersecurity company Wiz discovered the flaws with the help of several artificial intelligence (AI) tools. The company said it had collaborated with OpenAI and the cybersecurity firm Calif on the work. Wiz’s report estimated that the PHP vulnerability affected around 70% of the Internet and had existed undetected for more than a decade, but AI tools helped quickly identify a fix for it.
"With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” it said. – Bloomberg
