48 hours of no sleep for the cyber security world

According to Reuters, many companies and governments around the world rushed to update security patches related to the PHP programming language after two PHP2Shell vulnerabilities were made public on October 21. Both allow hackers to remotely execute code on any PHP server without authentication, creating conditions for bad guys to steal data and read sensitive information.

Cloudflare CEO Matthew Prince wrote on Twitter on October 22: "In the 10 hours before the vulnerability was announced, thousands of exploitation attempts were recorded across the Cloudflare network. The number skyrocketed to tens of thousands in 45 minutes after the announcement, hundreds of thousands within 2 hours, and is now up to millions."

A series of government websites, banking services, airlines, railways, taxes... from Tokyo, Japan to Helsinki, Finland had to proactively temporarily close to evaluate the system and patch errors. Matt Suiche, a researcher at cybersecurity startup Tolmo, said this level of urgency is "very new." "A year ago, such a situation never existed," he said. "What makes things urgent is that everyone has AI-augmented capabilities, not just the defenders but also the attackers."

"Companies are racing to update their systems before hackers use AI to successfully exploit vulnerabilities," explains Madeline Lawrence, co-founder of Belgian cybersecurity company Aikido Security.

About 70% of global websites operate on the PHP programming language. Two PHP2Shell vulnerabilities have been lurking in the PHP source code for years, but were too difficult to exploit and largely forgotten. But AI figured it out.

"It's been a long time since I've seen an incident like that. I know technology and cybersecurity workers have had a long, hard day," Satya Nadella, CEO of Microsoft, expressed at an event in Germany on October 22.

"Incidents like this are truly a nightmare. Since Tuesday night until now, I haven't slept at all. I've been up for 48 hours processing it. Balancing my time to update everything makes me exhausted," Nick Woodhead, founder of GPTree and Chief Technology Officer at Rothco and Compubox, told Business Insider on October 23.

He said, the problem is not simply about installing the patch, it is important to ensure that no data or systems have been previously leaked. "We had the infrastructure in place to make patch deployment easy, but the process still required a lot of manual work," Woodhead explained.

It is difficult for hackers to exploit PHP vulnerabilities

Despite recording millions of hacker attempts in two days, experts say there are some signs that hackers are having difficulty taking advantage of the vulnerability.

"Despite a thorough review of the entire monitoring system, we have only discovered a few real-world exploits. I feel like the vulnerability is more difficult to exploit than initially expected, so the incident may continue to simmer," Don Smith, Vice President of threat research at British security company Sophos, told NBC.

Researchers from nine major security companies including CrowdStrike, ESET, Google Threat Intelligence Group, Huntress, Palo Alto Networks, Recorded Future, SecureWorks, Sophos and Trail of Bits have not recorded any successful attacks as of October 23.

"Currently we have not seen PHP vulnerabilities exploited in the wild by cybercriminals," said Sherrod DeGrippo, Vice President of Threat Analysis at Palo Alto Networks. "However, we have discovered more than 200 proof-of-concept exploits (PoCs) and are actively investigating."

Dan Guido, CEO of cybersecurity research and consulting company Trail of Bits, said that in theory, the vulnerability could cause great damage, but exploiting it in practice is not easy.

According to him, to penetrate a highly secure website, hackers need more than a few pieces of test code, especially if relying on open source AI. In fact, these models are not as powerful as the tools of leading security experts and often have difficulty facing complex vulnerabilities.

However, Justin Timothy, a consultant with the security research and intelligence group GuidePoint (GRIT), emphasized that hunting for early signs is extremely important, and platform administrators need to guard against future risks. "There are currently no signs that the vulnerability has been compromised on a large scale. However, a 'clean' result does not mean that the possibility of compromise has been ruled out," he told TechTarget.

Behind the scenes of the race to prevent 'chaos on the Internet'