PHP flaws draw millions of hacking attempts amid global push for fixes

Hackers have made millions of attempts to exploit newly disclosed flaws in PHP, widely used software that helps run websites worldwide, as government agencies and businesses work to install emergency fixes, cyber threat intelligence firms say.

Cloudflare CEO Matthew Prince said the company detected thousands of attempts across its network during the 10 hours before the vulnerabilities were formally announced. That rose to hundreds of thousands within two hours of the announcement and eventually millions, he wrote in a post on X.

Others have reported similar activity. Cisco Talos said it observed attack attempts within hours of disclosure. Arctic Wolf detected attempts to make targeted servers download additional software, though it could not confirm those downloads succeeded.

The vulnerabilities, known as PHP2Shell, could let hackers run commands on a website’s server without logging in, potentially giving them access to sensitive data or control over the site, officials and experts say. 

It’s unclear how many hackers are involved in the efforts or how many systems have been successfully breached.

U.S. cybersecurity agencies urged organizations Wednesday to install updates immediately or disconnect affected systems that cannot be secured promptly.

PHP works behind the scenes to handle tasks such as processing online forms and retrieving information. Website platforms like WordPress and Drupal rely on it. Updating those platforms or their plugins alone does not necessarily fix the flaws if the underlying PHP software remains vulnerable.

The global patching scramble began before the scheduled release of the fixes. Information about the vulnerabilities surfaced on the Hacker News discussion forum Tuesday, according to cybersecurity company Huntress. The post was removed, but screenshots circulated on social media. PHP’s developers subsequently announced emergency updates for Wednesday, a day ahead of the original disclosure schedule.

Notably, Cloudflare said it observed attempts to exploit the flaws before the official release, including attackers changing their requests to try to evade its protections.

In an updated assessment, Talos said most activity so far has involved searching for vulnerable systems, alongside scattered attempts to deliver software to them. The company expects more organized attacks as hacking groups adapt their tools to exploit the weaknesses.

Cybersecurity company Arctic Wolf described attempts to gather information about targeted servers and download files from an outside address. Researchers found malware at that address associated with Potassium, a botnet that uses compromised devices to overwhelm other systems with internet traffic.

Arctic Wolf said it had found relatively little evidence so far of attackers reliably exploiting the flaws on a large scale.

Internet monitoring company Censys identified about 39.7 million internet-accessible services reporting PHP versions affected by the flaws, including roughly 12.8 million in the United States, according to a dashboard snapshot reviewed by Nextgov/FCW at the time of publication. It also recorded about 1.34 million services moving from an affected version to a fixed release since tracking began Oct. 21.

Those figures count services rather than individual websites or organizations. Censys cautioned that its version-based estimates may overstate exposure because some software suppliers add security fixes without changing the PHP version number its scans detect.

A separate OX Security analysis examined more than 2.2 million PHP installations listed by Shodan, a search engine that catalogs internet-connected systems. A day after the fixes became available, about 1.97 million records showed versions in the affected range, compared with 14,151 showing newly patched releases.

Installing the updates can also require coordination with whoever operates a website’s server. Browser security company Island noted that responsibility for PHP may belong to a hosting provider or the contractor that built the site, rather than the staff who manage its content. Upgrading older software can also break website features, requiring additional testing and repairs.

PHP’s developers released updates for its four supported versions Wednesday. They also provided limited fixes for some older versions that no longer receive routine support. Organizations using older releases may be able to obtain fixes through their software vendors.

AI helped researchers find the weaknesses and develop working demonstrations of how to exploit them. Island warned that attackers could use similar tools to adapt attacks to different websites, increasing pressure on organizations still identifying and repairing affected systems.

The threat intelligence reports do not say whether AI was used in the observed attack attempts.

“There’s an important paradox here. We want AI to move quickly enough to find vulnerabilities humans might miss, while also making sure that increasingly autonomous systems operate within boundaries we understand and control,” said Raghu Nandakumara, the VP of industry strategy at Illumio. “The faster AI becomes at finding weaknesses, the more important it becomes to think about what happens after those weaknesses are exposed, especially when organizations can’t immediately patch every affected system.”