Hackers Find Limited Success Exploiting Newly Disclosed PHP Vulnerabilities
Despite global warnings to take websites offline, security firms report few confirmed exploitation attempts of the recently disclosed PHP flaws, though the risk remains.
One day after governments and intelligence agencies urged websites to go offline until patches could be applied, cybersecurity firms said there have been only a handful of confirmed exploitation attempts of the newly disclosed PHP vulnerabilities.
"Across all our telemetry, and we are looking hard, we have only seen a couple of real exploitation attempts," said Don Smith, vice president of threat research at Sophos. He added that the flaws appear harder to exploit than initially expected, suggesting a slower-burn threat.
The vulnerabilities affect PHP, a language used by an estimated 69% of websites. After researchers identified the flaws in August, an international effort produced patches that were released on Wednesday, prompting agencies such as the FBI, NSA, European cybersecurity authorities and Australian intelligence agencies to recommend that sites go dark until the fixes were applied.
Representatives from nine leading security companies, including CrowdStrike, ESET, Google Threat Intelligence Group, Huntress, Palo Alto Networks, Recorded Future, SecureWorks, Sophos and Trail of Bits, told NBC News that as of Thursday evening they had not observed any successful attacks in the wild.
"We have not yet seen these PHP vulnerabilities exploited in the wild yet," said Sherrod DeGrippo, vice president of threat intelligence at Palo Alto Networks' Unit 42. She noted that over 200 proof-of-concept exploit codes have been identified and are under investigation.
Trail of Bits CEO Dan Guido said the flaws are technically complex, noting that it took a veteran employee an entire day to develop a working exploit using an advanced AI model. Amazon Web Services reported using honeypots to detect attempted exploitation attempts at least four days before the vulnerabilities were publicly disclosed, but said it remains unclear whether any attempts would have succeeded in real-world systems.
Cloudflare CEO Matthew Prince said the company had been preparing patches for months and had not seen any customer impact, warning that a compromise could occur quietly without public evidence.
Experts emphasized that creating functional exploits requires significant expertise and that open-weight AI models, which are more accessible to attackers, struggle with the complexity of the PHP flaws.