Hackers appear to be struggling to exploit PHP flaws after global cybersecurity crisis

In the wake of global alerts issued by governments regarding critical vulnerabilities in software, it appears that hackers are facing challenges in exploiting these flaws. This follows a warning that websites might need to take their services offline until they can implement necessary fixes. As of Thursday, cybersecurity experts noted a lack of significant damage reports, though they cautioned that the situation could evolve, potentially extending the threat for weeks.

Don Smith, the vice president of threat research at Sophos, a British software security firm, indicated that their monitoring systems showed only a few genuine attempts at exploitation. He attributed the limited success in exploiting the vulnerabilities to a coordinated global effort that had already identified the flaws and developed fixes before they were publicly disclosed. Additionally, the current limitations of some popular AI models may have hindered hackers' attempts to take advantage of these vulnerabilities.

Smith remarked, “My sense is that these vulnerabilities are harder to exploit than folks thought at first, so this could be a slow burn.” The vulnerabilities in question are related to PHP, a programming language utilized by approximately 69% of all websites. Researchers discovered two significant software flaws in August and collaborated internationally to create patches, which were publicly released on Wednesday morning.

This led to an unusual recommendation from various government agencies, including the FBI, NSA, and European and Australian cybersecurity authorities, advising websites to temporarily shut down until they could apply the necessary patches. Many major websites worldwide complied with this guidance.

Despite evidence that hackers have been actively scanning for ways to exploit these vulnerabilities, representatives from nine leading cybersecurity firms—including CrowdStrike, ESET, Google Threat Intelligence Group, Huntress, Palo Alto Networks, Recorded Future, SecureWorks, Sophos, and Trail of Bits—reported to NBC News that, as of Thursday evening, no successful attacks had been documented. Sherrod DeGrippo, vice president of threat intelligence at Palo Alto Networks’ Unit 42, stated, “We have not yet seen these PHP vulnerabilities exploited in the wild yet.”

DeGrippo further noted that while there were over 200 examples of proof-of-concept exploit code, the investigation into these claims was ongoing, emphasizing that the emergence of actual active exploits could happen at any moment. Dan Guido, CEO of Trail of Bits, explained that although the vulnerabilities are alarming in theory, they are also technically complex to exploit. He shared that one of his experienced employees took an entire day to successfully exploit the vulnerabilities using an advanced AI model.

Amazon Web Services reported that they had set up honeypots—deceptive websites designed to lure and monitor hackers—and discovered attempts to exploit the PHP vulnerabilities four days prior to their public disclosure. “Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems,” the company conveyed in a blog post.

Matthew Prince, CEO of Cloudflare, noted that the company had been preparing to address the flaw for several months, asserting that none of their customers had been compromised. He cautioned that the potential for quiet compromises exists, stating, “The scary thing here is that something could have gotten compromised very quietly. There may not be any public evidence that the server was compromised, and the hacker could just be hanging out there.”

While the risk of dormant intruders remains in any hacking scenario, Guido emphasized that successfully exploiting sophisticated web properties requires more than just basic code and a stroke of luck. This is particularly true for hackers utilizing open-weight AI models, which are less capable than those employed by frontline cybersecurity researchers and may struggle with complex vulnerabilities such as those found in PHP.