Critical flaw in PHP programming language leaves millions of websites vulnerable to attack

Websites across the globe are facing a massive onslaught of attempts to exploit a critical flaw in their code, leaving many online services vulnerable to attack.

Cybersecurity companies have reported that millions of websites are being targeted by hackers seeking to take advantage of the vulnerability in PHP, a programming language used by about 70% of the world's websites. The issue is so severe that governments and companies are taking drastic measures to prevent attacks. Many websites have been taken offline as their owners rush to patch the flaw.

In the UK, the situation has reached crisis point with 32 government services being temporarily pulled from the internet. According to the cybersecurity minister, Liz Lloyd, this decision was made as a precautionary measure while updates were applied to address the vulnerability. Downing Street has reassured that no critical public-facing services have been affected by the issue.

The shutdown of popular websites such as the BBC's Traitors highlights concerns about the ongoing vulnerability of systems used by schools, local governments and charities that may not have dedicated cybersecurity support to execute the fix. This has sparked fears that many organizations may struggle to protect themselves from potential attacks while they wait for patches to be applied.

The scale of attempted exploitation is staggering, with tens of thousands of attempts detected in just 45 minutes after the problem was announced. This number skyrocketed to hundreds of thousands within two hours and has now reached millions, according to Matthew Prince, chief executive of Cloudflare.

Researchers at Calif, who were instrumental in discovering the flaw, have expressed concern that exploitation may not be as widespread as feared, but the sheer volume of attempts suggests a significant threat remains. This is particularly worrying given that many organizations are still waiting for patches to be applied.

The vulnerability, known as PHP2Shell, has been identified by Amazon Threat Intelligence as being broadly exploited in the wild. The company has detected multiple actors attempting to test ways to capitalize on the weakness before the fix was released by the PHP developers on Wednesday.

As a result of this rapid exploitation, governments have taken swift action to protect their websites and data. Many government sites were quickly taken offline so that patches could be installed, with some coming back online soon after.

Cloudflare's Matthew Prince has highlighted the urgency of the situation, emphasizing that organizations must act swiftly to protect themselves from potential attacks while they wait for patches to be applied.

The PHP vulnerability has sparked concerns over the handling of security alerts, with some questioning whether the issue was revealed too early.

Cloudflare's data suggests thousands of attempts to exploit the weakness in just 10 hours before it was publicly announced. This rapid response highlights the urgency of the situation and the need for swift action by organizations to protect themselves from potential attacks while waiting for patches to be applied.

The vulnerability could allow hostile actors to seize control of exposed sites, granting them access to valuable resources such as computing power, servers, and IP addresses that locate a website on the internet. These assets are often managed and mediated through PHP, making it an attractive target for malicious activities.

Criminal groups, state-sponsored hackers, or crypto miners could "nest" themselves into exposed sites using this vulnerability and exploit those resources for their own purposes. This could include launching attacks from a compromised IP address that cannot be traced back to the perpetrator, or utilizing a server's computing power to run energy-intensive calculations without incurring costs.

It remains unclear at what scale this has been done, with some sites potentially unaware of the exposure. The lack of awareness highlights the need for organizations to take proactive measures to protect themselves from potential attacks while patches are being applied.

The severity of the vulnerability is underscored by Wiz's assessment that it was among the most severe software flaws ever discovered. Demonstrating its exploitability required a complex chain of steps, but frontier AI models reduced this barrier significantly, turning a longstanding weakness into an actionable threat.

Websites worldwide are facing a significant threat as cyber-actors seek to exploit a flaw in PHP code, prompting swift action from governments and industries. The US National Security Agency (NSA) has warned that this vulnerability could be turned into an actionable threat by exploiting AI models.

The South Korean government has activated emergency response measures, increasing its cybersecurity alert level and providing guidance to tens of thousands of companies on how to fix the issue. In China, the industry ministry is urging organisations to inspect their systems and upgrade to the latest secure version of PHP, while also strengthening cybersecurity monitoring and changing passwords and keys.