Even After Patches Are Released, a Gap Remains Before They’re Applied… a “Race Against Time”Security Staff and Technical Support Needed
Attempts to launch hacking attacks targeting security flaws in PHP, a web development language, surged to millions in a single day, turning the application of security updates into a race against time for companies. Patches to fix the vulnerability are being distributed, but as attack attempts also rise sharply, it has become crucial for companies to shorten their response times. Calls are growing for companies to strengthen their security staffing and response capabilities to prevent delays in applying patches.
On October 22 local time, Matthew Prince, chief executive officer (CEO) of global internet infrastructure company Cloudflare, said attempts to exploit the PHP2Shell vulnerability had surged since it was discovered. In a post on X (formerly Twitter), Prince said, “Across the Cloudflare network, there were thousands of exploitation attempts 10 hours before the public announcement.” He added, “The number surged to tens of thousands within 45 minutes of the announcement, reached hundreds of thousands within two hours, and now stands at millions.”CJ Moses, Amazon’s chief information security officer (CISO) and vice president of security engineering, said attempts to exploit the PHP2Shell vulnerability began on October 17, four days before it was officially disclosed. He said Amazon observed attempts believed to involve multiple attackers on the day of the disclosure, and also saw additional attack code emerge and being used just hours after the patch was released.British cybersecurity company Sophos also reported observing scans targeting the PHP vulnerability and a small number of exploitation attempts that day. It said that attack code that worked in a laboratory had not succeeded in real-world environments because system architectures, PHP versions and configurations varied. However, it stressed that attackers may develop techniques to overcome these conditions over time, making it necessary to apply security patches promptly.There were also signs that code reproducing the attack spread rapidly shortly after the vulnerability was disclosed. According to an analysis by South Korean cybersecurity company AhnLab, 99 of the top 100 repositories returned by searching for “php2shell” on GitHub had been created within a single day. Of the 1,394 “stars” left on the repositories, 83% were concentrated on repositories containing code that reproduced the attack, indicating strong interest in code that demonstrated how the vulnerability worked.With attack attempts surging after the vulnerability was disclosed, closing the gap between patch distribution and actual application has emerged as a key challenge. Even after a patch is obtained, a response cannot be considered complete until it has been applied and verified on each system. Companies must identify the servers running PHP in their active services and determine their versions, then apply updates and confirm that existing functions continue to work properly.
“The Transfer Failed, but ‘Ding Dong’ Money Came In”… 32.5 Billion Won Financial Incident at Toss Bank
Park Chun-sik, a professor in the Department of Cybersecurity at Ajou University, said, “PHP is widely used, and once a vulnerability is disclosed, even attackers without the ability to find it themselves can attempt to exploit it, so attacks can increase quickly.” He added, “If a web hosting provider used by multiple websites is attacked, the damage could spread to service disruptions or information leaks at the sites using its servers.” He continued, “To ensure that patches are applied without delay, companies need to raise security awareness, expand their pool of specialized personnel and provide technical support to close response gaps.”
This content was produced with the assistance of AI translation services.
© The Asia Business Daily. All rights reserved. Unauthorized AI training and use prohibited.
Click Here For The Original Source
——————————————————–
