The global emergency remediation effort targeting a critical PHP vulnerability has entered its second day, with the situation remaining tense. Researchers warn that hacker attack attempts have surged from several thousand to millions before and after the vulnerability's public disclosure, and the possibility that some systems have been compromised cannot be ruled out.
On Thursday, the United Kingdom confirmed that more than 30 government services remain offline pending the completion of security update deployments. Telecommunications operator Orange also announced on Thursday that it had suspended access to some websites and applications.
A day earlier, dozens of countries and regions including Austria, the Netherlands, Finland, and France had successively taken similar measures, while several Japanese banks and airlines also interrupted some online services.
Cloudflare CEO Matthew Prince revealed that 10 hours before the vulnerability was publicly disclosed, its systems had already identified thousands of exploitation attempts targeting the flaw; within two hours after the announcement was published, the number of attacks surged to hundreds of thousands, and subsequently climbed further to millions. It remains unclear how many intrusion attempts ultimately succeeded in stealing data or breaching systems.
Palo Alto Networks stated that it has identified over 22.6 million "exposed instances" containing the vulnerability, a scale it described as "extremely massive."
On Thursday, the Cybersecurity Threat and Vulnerability Information Sharing Platform of the Ministry of Industry and Information Technology issued an emergency alert stating that PHP contains two ultra-critical remote code execution vulnerabilities, which allow attackers to directly compromise target systems without any authentication, and recommending that relevant organizations and users immediately investigate and upgrade to the latest security versions.
Targeted Attacks Occurred Before Public Disclosure
According to disclosures by Amazon researchers, hackers had already attempted to exploit the vulnerability before it was made public. In a report released on Wednesday, Amazon's threat intelligence unit noted that an unidentified "threat actor" had somehow obtained relevant information before the vulnerability details were disclosed and launched attacks against Amazon's sensor network used to track cybercriminal activity, after which the company also detected multiple other exploitation attempts.
Matt Hull, Vice President of Cyber Intelligence and Response at NCC Group, said the window between when a vulnerability becomes known and when patches are fully deployed is critical, requiring affected organizations to act swiftly. "There is a real possibility that vulnerable systems have already been compromised, including through the implantation of backdoors," he said. "The potential impact should not be underestimated."
Currently, the U.S. Office of the National Cyber Director is coordinating with the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, the National Security Agency, and other agencies to jointly respond to the incident.
Impact Scope Covers 70% of the Global Internet
PHP is one of the most widely deployed technologies on the internet, supporting the operation of millions of websites and powering up to 70% of the global internet infrastructure.
Major content management systems such as WordPress, Drupal, Joomla, and Magento are all built on PHP. Cybersecurity firm Huntress noted that PHP is also widely "hidden" inside various types of software, even when the relevant software does not publicly declare that it uses PHP.
Once any such foundational vulnerability is exploited, it could produce cascading effects throughout the internet software supply chain, exposing online services to risks including data theft, malware implantation, and system breaches.
Taking websites temporarily offline is a standard defensive measure to block attackers from exploiting the vulnerability during patch deployment. The PHP development team released a software update on Wednesday and urged users to adopt it immediately.
AI Tools Facilitate Vulnerability Discovery and Remediation
The vulnerability was discovered by Wiz, a cybersecurity company under Alphabet, with the help of multiple artificial intelligence tools.
In its report, Wiz stated that it completed the research in collaboration with OpenAI and cybersecurity firm Calif, and estimated that the vulnerability had existed undetected for more than a decade.
"With frontier AI models and the right tools, one researcher accomplished in a week what previously would have taken a world-class team months to complete," Wiz wrote in its report.
The company said AI tools not only helped rapidly identify the vulnerability but also accelerated the formation of remediation solutions, playing a key role in this emergency response.
Comments