[PHP Security Alert] Millions of Attack Attempts Within Hours of Flaw Disclosure

Even After Patches Are Released, a Gap Remains Before They're Applied... a "Race Against Time"
Security Staff and Technical Support Needed

As attempts to hack systems by exploiting a security flaw in PHP, a web development language, surged to millions in a single day, companies are racing against time to apply security updates. Although a patch to fix the vulnerability has been released, attempts to exploit it are also rising sharply, making it critical for companies to shorten their response times. Some say companies need to strengthen their security personnel and response capabilities to prevent delays in applying the patch.

On Oct. 22 (local time), Matthew Prince, CEO of global internet infrastructure company Cloudflare, said attempts to exploit the PHP2Shell vulnerability had surged since it was discovered. In a post on X (formerly Twitter), Prince said, "There were thousands of exploitation attempts across the Cloudflare network 10 hours before the public announcement. Within 45 minutes of the announcement, that number surged to tens of thousands, reached hundreds of thousands within two hours, and now stands at millions."

CJ Moses, Amazon's chief information security officer (CISO) and vice president of security engineering, said attempts to exploit the PHP2Shell vulnerability began on the 17th, four days before it was officially disclosed. He said Amazon observed attempts believed to involve multiple attackers on the day of the disclosure, and saw additional attack code emerge and being used just hours after the patch was released.

British cybersecurity company Sophos also reported observing scans targeting the PHP vulnerability and a small number of exploitation attempts that day. It said attack code that worked in a lab did not succeed in real-world environments because system architectures, PHP versions, and configurations vary. However, it stressed that security patches need to be applied promptly, as attackers may develop techniques to overcome these conditions over time.

There were also signs that code reproducing the attack spread rapidly shortly after the vulnerability was disclosed. According to an analysis by South Korean cybersecurity company AhnLab, 99 of the top 100 repositories returned by a GitHub search for "php2shell" were created in a single day. Of the 1,394 "stars" left on the repositories, 83% were on repositories containing code that reproduced the attack, indicating strong interest in code that demonstrates how the vulnerability works.

As attempts to exploit the vulnerability surge following its disclosure, reducing the gap between patch releases and their actual application has emerged as a key challenge. Even if a patch has been obtained, a response cannot be considered complete until it has been applied to each system and verified. Companies must identify the servers and PHP versions used by their active services, install updates, and then check that existing functions are working properly.

Park Chunsik, a professor in the Department of Cybersecurity at Ajou University, said, "PHP is widely used, and once a vulnerability is disclosed, even attackers without the ability to find it themselves can try to exploit it, so attacks can increase rapidly. If a web hosting provider used by multiple websites is attacked, the damage could spread to include service disruptions or information leaks at sites using its servers." He added, "To prevent delays in applying patches even when they are released quickly, companies should raise security awareness, expand their pool of specialized personnel, and provide technical support to close gaps in their response."

This content was produced with the assistance of AI translation services.