From The Next Web · Ana Maria Constantin · · 1m 30s
PHP2Shell attacked millions of times, no breaches confirmed
Hackers launched millions of exploitation attempts after the PHP2Shell vulnerability was disclosed, but officials across multiple countries say they have seen no successful breaches.
In brief
Hackers launched millions of exploitation attempts after the PHP2Shell vulnerability was disclosed, but officials across multiple countries say they have seen no successful breaches. PHP2Shell has been attacked millions of times since disclosure on October twenty-second, but Germany, the Netherlands, Japan and the US…
Millions of attacks, no breaches
Cloudflare's Matthew Prince said hackers made millions of exploitation attempts against PHP2Shell after Wednesday's disclosure. Germany, the Netherlands and Japan report no successful breaches.
Attack attempts escalated rapidly
Cloudflare saw thousands of attempts in the ten hours before the announcement. That jumped to tens of thousands in the next forty-five minutes and hundreds of thousands within two hours.
Exploitation harder than expected
Germany's cyber agency BSI vice-president Thomas Caspers told Politico the flaw seems more complicated to exploit than officials expected during the planning process before the patch release.
“It seems a little bit more complicated than expected to exploit.”
Banks and airlines disrupted
Mizuho's bank and securities arms halted services. Shizuoka Bank suspended its website and app. All Nippon Airways disabled boarding passes in Apple Wallet. Japan Airlines, East Japan Railway and Seven-Eleven Japan took web services down.
Attacks began before disclosure
Someone tried to exploit PHP2Shell on October seventeenth, four days before public disclosure, hitting Amazon's decoy servers from an anonymised address.
Dispute over embargo breach
The PHP Foundation said Chainguard broke the embargo by publishing patched images more than six hours before the release.Chainguard's chief executive Dan Lorenc said his company did not leak and would not do anything differently.
“It's coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild.”
The essence
PHP2Shell has been attacked millions of times since disclosure on October twenty-second, but Germany, the Netherlands, Japan and the US report no confirmed successful exploits.
