Global companies and governments rushed Thursday to fix critical flaws in the PHP programming language that powers much of the Internet Cloud company reported a wave of Hacker attempts afterwards The Vulnerabilities were disclosed.
The move came after governments in Europe and elsewhere took websites offline as a precautionary measure on Wednesday while website operators scrambled to secure systems running the software.
The emergency closures of banking, airline, rail, tax and government services from Tokyo to Helsinki represent one of the most dramatic tests of the decades-old programming tools that keep the Internet running, and show how much governments and companies rely on code that few people understand.
“I haven’t seen anything like this in a long time,” Microsoft CEO Satya Nadella said at an event in Germany on October 21, saying the incident shows the importance of developing software that can be safely maintained as systems become more complex.
“I know it’s been a long day and night for all the IT and security people.”
PHP KEYS TO THE BASICS OF THE INTERNET LIKE HTML, PYTHON
The developers of PHP – a computer language like HTML and Python – released fixes on October 20 for vulnerabilities that had been lurking in the software for years until they were discovered using AI. They pushed Users should “update immediately.”
Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, said details of the vulnerabilities became public before fixes were ready and attacks have been reported since then.
“Companies are in a race to provide updates against attackers who can use AI to exploit them. That’s the whole race,” she said.
According to cloud service providers Cloudflare and Amazon, hacking attempts rose into the millions as companies and governments rolled out patches and blocked websites as a precaution.
“In the 10 hours leading up to the public announcement, we saw thousands of attempts to exploit it across the network,” Cloudflare CEO Matthew Prince said in a post on X late Wednesday.
“In the 45 minutes of the announcement the number rose to tens of thousands, within two hours to hundreds of thousands and now to millions.” Amazon also said it was seen widespread exploitation.
EFFECTS FROM JAPAN TO FINLAND
Japanese companies including brokerage firm Nomura, lender Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway said on Oct. 21 that they would temporarily suspend some internet services as part of emergency measures.
Brewer Asahi Group Holdings has temporarily suspended certain websites and systems and conducted a security impact assessment. Insurer Tokio Marine Holdings said it had blocked its group’s website.
Japan’s Ministry of Finance and the Meteorological Agency have partially suspended online services to implement security measures, while Japan’s National Tax Administration has temporarily suspended its service.
The precautionary shutdowns show Japan’s growing concerns about cybersecurity, as the country recorded more cyber incidents in the first nine months of the year than in all of last year, according to data from TrendAI.
The French telecommunications group Orange said it had temporarily blocked access to certain PHP-based websites and applications in several subsidiaries as a precautionary measure.
Tencent Cloud, one of China’s largest cloud computing providers, urged its customers to install updated versions of PHP but did not call for widespread closures of websites.
Finland’s state IT service provider Valtori said it continued to install PHP security patches overnight and gradually lifted precautionary service blocks after shutting down the government’s public web services a day earlier.
“Restoring services may take days or even weeks as systems require careful testing in addition to updates,” Valtori general director Hannu Naumanen said in a statement.
Valtori said the outages were not caused by exploitation of the vulnerabilities or a cyber breach and that it was not aware of any active exploitation of the vulnerabilities.
Some fixes may take weeks to implement
Several Asian governments ordered cybersecurity inspections related to the PHP vulnerabilities on Thursday.
China’s Ministry of Industry urged organizations and users to review and update systems to the latest secure version of PHP. It also recommended strengthening cybersecurity monitoring and changing accounts, passwords and keys when necessary.
South Korea has raised its cybersecurity alert level for the private sector and taken emergency measures, raising concerns about an increased risk of hacker attacks.
Felix Kuhlenkamp, head of security at German digital industry association Bitkom, said many larger operators had already implemented updates, but for complex IT systems and smaller organizations it could take longer.
“You might be running a website using PHP, but not really keeping an eye on it,” he said. “If a website is based on an old version of PHP for which there is no security update, the entire system needs to be updated.”
Topics
Cyber
