Overview
- A serious vulnerability in the PHP programming language was publicly disclosed on Oct. 21 and the published fix immediately spurred widespread scanning and exploit attempts.
- Security teams reported evidence of probing before disclosure, with Amazon Threat Intelligence detecting attack attempts on Oct. 17 and firms noting millions of exploit tries within about 12 hours after the patch was posted.
- The flaw can let an attacker read stored personal data and change site content by interacting directly with PHP code that normally runs on the server side.
- In Japan, the Tokyo Metropolitan Government, multiple prefectures, major banks, rail operators including JR Central and many local governments suspended or limited web services as a precaution while applying patches and monitoring systems.
- Small and medium firms face the biggest risk because many outsource web work and may not know if their sites use PHP, so experts warn full validation and recovery could take weeks to months and will require coordinated patching and vendor checks.