Bloomberg：黑客在PHP严重漏洞公开前数天即尝试利用，全球多国政府及日本银行、Orange等下线网站应急打补丁

Hackers attempted to exploit security vulnerabilities in the widely used programming language PHP several days before the flaws became public, according to cybersecurity researchers at Amazon.com Inc.

The flaws were revealed on Wednesday and forced governments and organizations across the world to take websites offline as a precaution as they worked to implement a security update.

Read More: US Urges Fix for Widely Used Software After Critical Alerts

PHP contains two vulnerabilities which could potentially expose organizations using it in websites and software platforms to cyberattacks. The developers responsible for maintaining PHP said Wednesday they released software updates to patch the flaws, urging users to adopt those changes immediately.

PHP is one of the web’s most widely deployed technologies, underpinning millions of websites. Any weakness could therefore cascade through the internet’s software supply chain, potentially exposing online services to data theft, malware and breaches. Taking sites offline means attackers can’t reach and exploit a flaw while it’s being fixed.

On Oct. 17, several days before the flaws were public, Amazon’s threat intelligence unit said it identified hackers attempting to exploit a network of “honeypot” sensors it uses to track and analyze cybercrime.

In a report published on Wednesday, Amazon said that the activity was conducted by an unknown “threat actor” who had somehow obtained information about the vulnerabilities prior to the public release of details about them.

Amazon later detected several other exploitation attempts. After the public disclosure, Amazon said the flaws were being “broadly exploited” by hackers, though it did not provide information on any hacking victims.

The window between security holes becoming known and organizations implementing a patch was critical and required swift action by any organization affected, said Matt Hull, vice president of cyber intelligence and response at NCC Group.

“There is a real possibility that vulnerable systems could already have been compromised, including the creation of backdoors,” said Hull. “The potential impact is serious.”

Telecommunications operator Orange said on Thursday that it was suspending access to some of its websites and applications while it deployed security patches for the vulnerabilities, according to statement.

In Japan, several banks and airlines took services offline. Mizuho Financial Group Inc.’s bank and security arms halted services and said they were taking emergency steps to improve security. Regional lender Shizuoka Bank suspended its website and app, while Mitsubishi UFJ Financial Group Inc. companies halted some online services.

Elsewhere, governments and organizations in countries including Austria, the Netherlands, Finland, France, Denmark, Australia, Canada, Germany, Belgium and the UK were among those to pull websites offline on Wednesday as they worked to implement fixes.

The US Office of the National Cyber Director was coordinating with the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, the National Security Agency and others to remediate the issue.

US cybersecurity company Palo Alto Networks said that it had identified more than 22.6 million “exposed instances” — such as a server, database, or application — containing the PHP vulnerabilities. Lee Klarich, Palo Alto’s chief product and technology officer, said the scale of the exposure was ”massive.”

PHP is “everywhere” and quietly powers websites that run using systems such as WordPress, Drupal, Joomla and Magento, according to the cybersecurity firm Huntress. PHP is also present “under the hood” of software, even though the software may not advertise that it is using it, Huntress said.

Researchers at Alphabet Inc.-owned cybersecurity company Wiz discovered the flaws with the help of several artificial intelligence tools. The company said it had collaborated with OpenAI and the cybersecurity firm Calif on the work. Wiz’s report estimated that the PHP vulnerability affected around 70% of the internet and had existed undetected for more than a decade, but AI tools helped quickly identify a fix for them.

“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” it said.