Governments, firms rush to patch PHP flaws as cyberattacks surge globally

Governments and companies worldwide are racing to patch critical PHP vulnerabilities as hackers launch millions of attempted attacks, disrupting public services and banking operations.

A rush to update websites and protect against vulnerabilities in a widely used programming language continued into its second day, with researchers warning that hackers have tried to exploit the weaknesses.

 

Disruption caused by the security issues began Wednesday after researchers disclosed that they had found two critical flaws in PHP that could potentially expose organisations using it in websites and software platforms to cyberattacks.

 

More than 30 government services in the United Kingdom (UK) remained offline Thursday while security updates are applied, Elizabeth Lloyd, the UK minister for space, cyber and regulatory reform, said in a statement Thursday.

 

PHP is one of the web’s most widely deployed technologies, powering millions of websites and underpinning up to 70 per cent of the internet. Any weakness could therefore cascade through the internet’s software supply chain, potentially exposing online services to data theft, malware and breaches.

 

 

Taking sites offline means attackers can’t reach and exploit a flaw while it’s being fixed. The developers responsible for maintaining PHP released software updates to patch the flaws on Wednesday, urging users to adopt those changes immediately.

 

Governments and organisations in countries including Austria, the Netherlands, Finland, France, Denmark, Australia, Canada, Germany and Belgium were among those to pull websites offline on Wednesday as they worked to implement fixes. The White House was also engaged with US federal agencies and critical infrastructure firms on the issue.

 

In Japan, several banks and airlines took services offline. Mizuho Financial Group Inc’s bank and security arms halted services and said they were taking emergency steps to improve security. Mitsubishi UFJ Financial Group Inc companies halted some online services.

 

Hackers already attempted to exploit PHP’s security holes in the days before the flaws were made public, according to researchers at Amazon.com Inc.

 

In a report published on Wednesday, Amazon said hacking attempts took place by an unknown “threat actor” who had somehow obtained information about the vulnerabilities prior to the public release of details about them.

 

Amazon’s threat intelligence unit said it identified hackers attempting to exploit a network of sensors it uses to track and analyse cybercriminal activity. The company later detected several other exploitation attempts.

 

Matthew Prince, chief executive officer at the cybersecurity company Cloudflare, said in a post on X that they had identified thousands of attempts to exploit the PHP vulnerabilities 10 hours before they were publicly announced.

 

Within two hours of the announcement, Prince said, the hacking attempts were in the hundreds of thousands and later increased into the millions. It’s not clear how many of those attempted intrusions were ultimately successful.

 

Major US banks are detecting unauthorised third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions, Axios reported on Thursday.