Websites across world hit by millions of attempts to exploit PHP code flaw

Websites around the world have been hit by millions of attempts to exploit a recently discovered vulnerability in their code, cybersecurity companies have said, as the US National Security Agency warned the flaw could allow attackers to take control of web servers, steal data and disrupt services.

The problem in the PHP programming language, which underpins about 70% of the world’s websites, emerged on Wednesday causing governments and companies to pull their websites off the internet before they could be attacked and so they could patch the fault.

The website for the BBC’s Traitors was one of those that was down on Thursday. It sparked particular concern about the ongoing vulnerability of systems used by schools, local governments and charities, which may not have dedicated cybersecurity support to execute the fix.

Ciaran Martin, the former chief executive of the UK’s National Cyber Security Centre, described the flaw as “very bad”, saying that while most internet software vulnerabilities didn’t matter, this was “the most serious vulnerability discovered for five years”.

However, Ryan Austin, a researcher at the cybersecurity company Calif, who was key to discovering the flaw, said: “At the moment it doesn’t look like exploitation has taken off or been widespread.”

The flaw prompted governments into action, with the US National Security Agency warning it could allow attackers to seize control of web servers, steal sensitive data, disrupt services and move deeper into a network. Government websites were quickly taken down so the patch could be installed with many coming back on line soon afterwards.

In an update overnight on Wednesday, and into Thursday, Matthew Prince, the chief executive of cybersecurity company Cloudflare, said the company saw tens of thousands of attempts to exploit the weakness in the 45 minutes after the problem was announced, rising to “hundreds of thousands within two hours, and millions now”.

Amazon Threat Intelligence, another cybersecurity company, added that PHP2Shell, as the vulnerability is known, was “now being broadly exploited in the wild” and said it identified several attempts from multiple actors to test ways to capitalise on the vulnerability before the fix was released by the PHP developers on Wednesday.

Cloudflare also said that in the 10 hours before it was publicly announced, it saw thousands of attempts to exploit the vulnerability, amid concern over the handling of the alert, with one cybersecurity expert, Prof Alan Woodward, saying the flaw was revealed a day before the patch was released, and that “somebody let the cat out of the bag”.

The PHP vulnerability could allow hostile actors to “grab the resources” of exposed sites, said Michał Woźniak, an internet infrastructure expert. A website, such as Slack or Wikipedia, has access to computing power, servers, and IP addresses – which locate it on the internet. In many cases, this infrastructure is managed and mediated by PHP.

Criminal groups, state-sponsored hackers, or crypto miners might “nest” themselves into exposed sites using this PHP vulnerability, and then exploit those resources for their own aims. A hacking group could use an exposed site’s IP address to launch attacks that could not then be traced back to it. Crypto miners could use a server’s computing power to run their energy-intensive calculations for free.

It is unclear at what scale this has been done, said Woźniak, and many sites would not even be aware of it.

Wiz, one of the research organisations that uncovered the vulnerabilities, said it was arguably among the most severe software vulnerabilities ever discovered.

“The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” it said in a blogpost. “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”

“Cyber-actors are likely to weaponise PHP2Shell,” the NSA said. “These risks are serious enough to require immediate patching across US government departments and agencies.”

The government of South Korea said on Thursday it was activating emergency response measures, raising its private sector cybersecurity alert level and issuing guidance to tens of thousands of companies on how to fix the problem. China’s industry ministry urged organisation to immediately inspect their systems and upgrade to the latest secure version of PHP and recommended strengthening cybersecurity monitoring, changing passwords and keys.

The prime minister of Japan encouraged businesses and organisations to patch the vulnerability – or shut down their sites.