Nine security firms see no successful attacks on new PHP flaws

One day after governments around the world warned that two newly publicized software vulnerabilities were so severe that websites should consider going offline until they could fix them, experts and insiders told NBC News there were few, if any, reports of widespread damage. That could still change, and cybersecurity experts warn the threat will remain for weeks, if not longer. But there were early signs on Thursday that hackers were finding it hard to capitalize on the flaws.

The vulnerabilities are in PHP, a website programming language used in an estimated 69% of all websites. Researchers quietly found the two flaws in August, then worked across borders and disciplines to develop patches, which were released Wednesday morning. Government agencies from the FBI and the National Security Agency to European cybersecurity authorities and Australian intelligence agencies recommended that websites go dark until they could apply the patches, and dozens of major websites around the world did so.

Researchers and spokespeople from nine companies (CrowdStrike, ESET, Google Threat Intelligence Group, Huntress, Palo Alto Networks, Recorded Future, SecureWorks, Sophos and Trail of Bits) told NBC News that as of Thursday evening they had not seen any successful attacks. Don Smith, vice president of threat research at the British security firm Sophos, said that across all its telemetry the company had seen only a couple of real exploitation attempts. He said his sense was that the flaws are harder to exploit than people first thought, so this could be a slow burn. Sherrod DeGrippo, vice president of threat intelligence at Palo Alto Networks' Unit 42, said the company had not yet seen the vulnerabilities exploited in the wild. Unit 42 has seen over 200 examples of proof-of-concept exploit code, programs that claimed to exploit the flaws, and is investigating all of them. She added that whether there are active exploits is only a matter of time.

Experts told NBC News the limited exploitation was partly due to the behind-the-scenes global effort that identified the flaw and quietly designed a fix. They said it was also helped, inadvertently, by the current limits of some widely available AI models, which did not appear very helpful at exploiting the vulnerabilities, and perhaps by a little luck. Experts also say there is plenty of evidence that hackers have been relentlessly scanning the flaws for ways to attack targets.

Dan Guido, CEO of the security research and consulting firm Trail of Bits, said the vulnerability was devastating in theory but technically very difficult to hack. He said one of his employees, a 10-year veteran, needed an entire day to hack the vulnerabilities with an advanced AI model. Guido said it takes more than experimental code and a little luck to compromise a sophisticated web property, especially for hackers relying on open-weight AI models, which they can tinker with and strip of guardrails. Those models are not as powerful as the ones available to front-line security researchers, and they typically struggle with complicated flaws like these.

There are warning signs too. Amazon Web Services said its honeypots, fake websites that researchers set up to trick and monitor hackers, found evidence that hackers were trying to exploit the PHP vulnerability at least four days before it was made public. In a blog post the company said technical analysis is ongoing and it is unclear whether any of those attempts would have succeeded in real-world systems. Matthew Prince, CEO of Cloudflare, said his company had been in talks for months about how to patch the flaw and that none of its customers were affected. He cautioned that something could have been compromised very quietly, with no public evidence, and the hacker could just be hanging out there.

Key facts

Two severe PHP vulnerabilities, found in August, were patched on Wednesday morning; PHP is used in an estimated 69% of all websites.
The FBI, NSA, European cybersecurity authorities and Australian intelligence agencies recommended that websites go dark until patched, and dozens of major websites did.
Nine security firms told NBC News they had seen no successful attacks as of Thursday evening; Sophos has seen only a couple of real exploitation attempts.
Palo Alto Networks' Unit 42 has seen over 200 proof-of-concept exploit programs and is investigating them all.
AWS honeypots found attempts to exploit the PHP vulnerability at least four days before disclosure, and experts warn the threat will last for weeks, if not longer.

Why it matters

PHP runs an estimated 69% of all websites, and the response was unusual: agencies including the FBI and NSA recommended that sites go offline until patched, and dozens of major sites did. The early picture, with no successful attacks reported by nine major security firms as of Thursday evening, suggests the quiet global effort to build a fix before disclosure bought time. Experts also say the limits of widely available AI models, which were not very helpful at exploiting the flaws, played a part.

Who it affects

Anyone running a website on PHP, which by one estimate is most of the web. Dozens of major sites took themselves offline. Cloudflare's CEO said none of its customers were affected. Security teams are also affected, since scanning for the flaws is widespread and Unit 42 alone is investigating over 200 proof-of-concept programs.

How to use it

The practical advice in the report is that governments recommended websites go dark until they could implement the patches, which were released Wednesday morning. Defenders should also treat proof-of-concept code with care: Guido says many people are confusing proof of concept with exploit, and Unit 42 is investigating each of the 200-plus samples it has seen.

How solid is it

The core finding rests on statements from nine named companies to NBC News, as of Thursday evening only. Several are on-record quotes from named executives at Sophos, Palo Alto Networks' Unit 42, Trail of Bits and Cloudflare. The AWS finding comes from the company's own blog post. The claim that limited exploitation was helped by weak AI models and some luck is attributed to unnamed experts. The picture is a snapshot after one day, and the report itself says it could change.

Risks and caveats

No successful attacks seen does not mean none happened. AWS honeypots saw exploitation attempts at least four days before disclosure, though it is unclear whether any would have succeeded. Prince warned that a compromise could be very quiet, with the hacker simply staying on the server. DeGrippo said active exploits are only a matter of time, Smith called it a possible slow burn, and experts expect the threat to last weeks or longer. Guido's view that exploiting the flaws takes real expertise applies to hackers using open-weight models; a well-resourced attacker with a stronger AI model is a different case, since his own employee managed it in a day.

“Across all our telemetry, and we are looking hard, we have only seen a couple of real exploitation attempts”

— Don Smith, vice president of threat research at Sophos