Hackers Struggle to Exploit PHP Flaws Used by 69% of Websites Despite Global Warnings
Updated
Updated · NBC News · Oct 22
Hackers Struggle to Exploit PHP Flaws Used by 69% of Websites Despite Global Warnings
3 articles · Updated · NBC News · Oct 22
Summary
Nine major cybersecurity firms said by Thursday evening they had seen no successful real-world attacks from the newly disclosed PHP vulnerabilities, despite intense scrutiny and only a handful of apparent exploitation attempts.
Two factors blunted the immediate threat: researchers had quietly coordinated patches before Wednesday’s disclosure, and experts said the flaws are far harder to weaponize than early fears suggested.
More than 200 proof-of-concept programs are circulating, and AWS honeypots detected probing at least four days before disclosure, showing attackers are actively testing the bugs even if success remains unconfirmed.
Dozens of major websites still went offline after agencies including the FBI, NSA and European authorities urged emergency patching, reflecting concern that intrusions could remain hidden and emerge later.