Attacks Detected 4 Days Before 'PHP Vulnerability' Disclosure... "Millions of Hacking Attempts"

Attacks exploiting a security vulnerability in PHP, a core internet programming language, began at least four days before the vulnerability was publicly disclosed.

CJ Moses, Vice President and Chief Information Security Officer (CISO) of Amazon, stated in a company security blog post on the 22nd (local time) that the company detected cases exploiting the vulnerability on the 17th, four days prior to the release of the vulnerability patch.

Moses added that additional threat attempts, believed to involve multiple attackers, were identified just hours before the vulnerability was officially announced on the day of disclosure.

Technical analysis of these attacks is currently underway.

It remains unclear whether the attackers successfully breached systems, and it is not yet known how they obtained relevant information prior to the public disclosure.

Moses also noted that just hours after the vulnerability was disclosed and patches were released, additional exploit code was generated and utilized.

Matthew Prince, CEO of cloud service and security firm Cloudflare, also shared on his X (formerly Twitter) account, "Thousands of attack attempts were observed across our network during the 10 hours before the official announcement," adding, "It surged to tens of thousands of attempts within 45 minutes of the announcement, hundreds of thousands within two hours, and has now reached millions."

Madeleine Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, told Reuters that detailed information about the vulnerability was disclosed before patches were ready, and subsequent attack cases have been reported.

Websites of banks, airlines, railways, national tax services, and government public services in major countries around the world have been shut down or isolated en masse as a precautionary measure due to concerns over attacks targeting the PHP vulnerability.

In Japan, Nomura Securities, All Nippon Airways (ANA), and East Japan Railway suspended some internet services temporarily, while government agencies such as the Ministry of Finance, the Japan Meteorological Agency, and the National Tax Agency also initiated precautionary service suspensions.

France's telecommunications group Orange blocked access to PHP-based websites and apps across its subsidiaries, and Valtori, Finland's state-owned IT service provider, is currently lifting blocks after applying security patches to suspended government public web services.

In South Korea, citing increasing concerns over hacking attacks, the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) activated response measures, raising the national cybersecurity crisis alert for the private sector from "Attention" to "Caution."

Microsoft (MS) CEO Satya Nadella remarked at an event in Cologne, Germany, on the same day, "I haven't seen anything like this in a very long time," pointing to the severity of the situation by adding, "It must have been a long day and a long night for all IT and security professionals."

Felix KulenKampff, head of security at Germany's digital industry association Bitkom, analyzed, "Many large companies have already completed updates, but complex IT systems or smaller institutions may take much longer."

Moses emphasized that with the advancement of AI technology, the time it takes from the disclosure of a vulnerability to the development of actual exploit tools has dramatically shortened, stressing that the patch deployment cycle must be reduced from the traditional 7 to 30 days down to a matter of hours.

※