Websites around the world have been hit by millions of attempts to exploit a recently discovered vulnerability in their code, cybersecurity companies have said, as the US warned the flaw could allow attackers to take control of web servers, steal data and disrupt services.
The problem in the PHP programming language, which underpins about 70% of the world's websites, emerged on Wednesday causing governments and companies to pull their websites off the internet before they could be attacked and so they could patch the fault.
In the UK, 32 government services had been taken offline, the cybersecurity minister, Liz Lloyd, told parliament. She said this “largely resulted from precautionary measures†while updates were applied. Downing Street said no public-facing critical services had been affected and “some limited services may be temporarily offline†but this did not mean they had been hacked.
The website for the BBC's Traitors was one of those that was down on Thursday, while the government declined to name the affected sites, saying services were being reviewed, updated and coming back online. The UK's National Cyber Security Centre (NCSC) sent out 50,000 alerts to affected organisations, but said it had no reports of successful hacks as a result of the flaw. Other sites reportedly temporarily affected included the Internet Archive, Wikipedia and 4Chan.
The vulnerability sparked particular concern about the ongoing vulnerability of systems used by schools, local governments and charities, which may not have dedicated cybersecurity support to execute the fix. The NCSC said the scale of the vulnerability was “unprecedented†and the patch would not work for some organisations running older systems, and these would have to be replaced. The British Chambers of Commerce, which represents thousands of employers, said it was not yet causing firms any significant difficulties.
Ciaran Martin, the former chief executive of the NCSC, described the flaw as “very badâ€, saying that while most internet software vulnerabilities did not matter, this was “the most serious vulnerability discovered for five yearsâ€. The former GCHQ chief David Omand warned that Russia and China could look to exploit the bug.
However, Ryan Austin, a researcher at the cybersecurity company Calif, who was key to discovering the flaw, said: “At the moment it doesn't look like exploitation has taken off or been widespread.â€
The flaw prompted governments into action, with the US National Security Agency saying it could allow attackers to seize control of web servers, steal sensitive data, disrupt services and move deeper into a network. Government websites were quickly taken down so the patch could be installed with many coming back on line soon afterwards.
In an update overnight on Wednesday, and into Thursday, Matthew Prince, the chief executive of the cybersecurity business CloudFlare, said the company encountered tens of thousands of attempts to exploit the weakness in the 45 minutes after the problem was announced, rising to “hundreds of thousands within two hours, and millions nowâ€.
Amazon Threat Intelligence, another cybersecurity company, said PHP2Shell, as the vulnerability is known, was “now being broadly exploited in the wild†and it had identified several attempts from multiple actors to test ways to capitalise on the vulnerability before the fix was released by the PHP developers on Wednesday.
CloudFlare also said that in the 10 hours before the vulnerability was publicly announced, it saw thousands of attempts to exploit it, amid concern over the handling of the alert. One cybersecurity expert, Prof Alan Woodward, said the flaw was revealed a day before the patch was released, and that “somebody let the cat out of the bagâ€.
after newsletter promotion
The PHP vulnerability could allow hostile actors to “grab the resources†of exposed sites, said Michał Woźniak, an internet infrastructure expert. A website, such as Slack or Wikipedia, has access to computing power, servers, and IP addresses which locate it on the internet. In many cases, this infrastructure is managed and mediated by PHP.
Criminal groups, state-sponsored hackers, or crypto miners might “nest†themselves into exposed sites using this PHP vulnerability, and then exploit those resources for their own aims. A hacking group could use an exposed site's IP address to launch attacks that could not then be traced back to it. Crypto miners could use a server's computing power to run their energy-intensive calculations for free.
It was unclear at what scale this has been done, said Woźniak, and many sites would not even be aware of it.
Wiz, one of the research organisations that uncovered the vulnerabilities, said it was arguably among the most severe software vulnerabilities ever discovered. “The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,†it said in a blogpost. “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.â€
“Cyber-actors are likely to weaponise PHP2Shell,†the NSA said. “These risks are serious enough to require immediate patching across US government departments and agencies.â€
The government of South Korea said on Thursday it was activating emergency response measures, raising its private sector cybersecurity alert level and issuing guidance to tens of thousands of companies on how to fix the problem.
China's industry ministry urged organisations to immediately inspect their systems and upgrade to the latest secure version of PHP, and recommended strengthening cybersecurity monitoring, changing passwords and keys. The prime minister of Japan encouraged businesses and organisations to patch the vulnerability – or shut down their sites.
