全球针对PHP关键漏洞的应急修复行动进入第二天，形势持续紧张。研究人员警告，在漏洞公开披露前后，黑客的攻击尝试已从数千次骤升至数百万次，部分系统被入侵的可能性不可排除。周四，英国确认，超过30项政府服务仍处于下线状态，以待安全更新完成部署。电信运营商Orange也于周四宣布暂停部分网站和应用的访问。
此前一天，奥地利、荷兰、芬兰、法国等数十个国家和地区已陆续采取类似措施，日本多家银行和航空公司亦中断了部分在线服务。
网络安全公司Cloudflare首席执行官Matthew Prince透露，在漏洞公开披露前10小时，其系统已识别出数千次针对该漏洞的利用尝试；公告发布后两小时内，攻击次数飙升至数十万次，随后进一步增至数百万次。目前尚不清楚有多少次入侵尝试最终成功窃取数据或入侵系统。
Palo Alto Networks则表示，已识别逾2260万个包含该漏洞的"暴露实例"，规模"极为庞大"。
周四，工业和信息化部网络安全威胁和漏洞信息共享平台发布紧急提示，PHP存在两个远程代码执行超危漏洞，攻击者无需任何身份验证即可直接入侵目标系统，建议相关单位和用户立即排查并升级至最新安全版本。
漏洞公开前已遭定向攻击
据亚马逊研究人员披露，黑客在漏洞公开之前便已尝试加以利用。亚马逊威胁情报部门在其周三发布的报告中指出，一名身份不明的"威胁行为者"在漏洞细节公开前已以某种方式获取了相关信息，并对亚马逊用于追踪网络犯罪活动的传感器网络发起攻击，此后该公司还检测到多次其他利用尝试。
NCC Group网络情报与响应副总裁Matt Hull表示，漏洞被知晓与补丁完成部署之间的窗口期至关重要，需要受影响机构迅速行动。"存在一种切实可能性，即脆弱系统已遭入侵，包括被植入后门，"他说，"潜在影响不容小觑。"
目前，美国国家网络总监办公室正协调联邦调查局、网络安全和基础设施安全局、国家安全局等机构共同应对此次事件。
影响范围覆盖全球70%互联网
PHP是互联网最广泛部署的技术之一，支撑着数百万个网站的运行，并驱动着全球高达70%的互联网基础设施。
WordPress、Drupal、Joomla和Magento等主流内容管理系统均以PHP为底层支撑。网络安全公司Huntress指出，PHP还广泛"隐身"于各类软件内部，即便相关软件并未对外声明使用了PHP。
任何此类基础性漏洞一旦被利用，均可能在互联网软件供应链中产生连锁效应，令在线服务面临数据窃取、恶意软件植入及系统泄露等风险。
将网站暂时下线，是在补丁部署期间阻断攻击者利用漏洞的常规防御手段。PHP开发团队已于周三发布软件更新，并敦促用户立即采用。
AI工具助力漏洞发现与修复
此次漏洞由Alphabet旗下网络安全公司Wiz借助多款人工智能工具发现。
Wiz在报告中表示，其与OpenAI及网络安全公司Calif合作完成了这项研究工作，并估计该漏洞在未被察觉的情况下已存在逾十年。
"借助前沿AI模型和合适的工具，一名研究员在一周内完成了此前世界级团队数月才能完成的工作，"Wiz在报告中写道。
该公司表示，AI工具不仅帮助快速识别了漏洞，也加速了修复方案的形成，在此次应急响应中发挥了关键作用。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
The global emergency recovery response to the critical PHP loophole entered the second day and continued to be tense. Researchers warned that before and after the public disclosure of the loopholes, hacker attacks had jumped from thousands to millions, and the possibility of some systems being invaded could not be ruled out. On Thursday, the United Kingdom confirmed that more than 30 government services were still on the downline pending a secure update to complete deployment. On Thursday, Orange, a telecommunications operator, also announced the suspension of some visits to websites and applications.
On the previous day, similar measures had been taken in dozens of countries and regions, including Austria, the Netherlands, Finland and France, and several banks and airlines in Japan had interrupted some of their online services.
The CEO of the Cybersecurity company Cloudflare, Matthew Prince, revealed that his system had identified thousands of attempts to exploit the loophole 10 hours before it was publicly disclosed; within two hours of the announcement of publish, the number of attacks soared to hundreds of thousands, and then to millions more. It is not clear how many invasion attempts have resulted in the theft of data or systems.
Palo Alto Networks states that over 22.6 million "exposures" containing that loophole have been identified on a "extreme scale".
On Thursday, publish, the Department of Industry and Information Technology ' s Internet security threat and loophole information-sharing platform, advised that PHP had two remote code implementation super-dangers and that the attackers could enter the target system directly without any identification, suggesting that the relevant units and users should be cleared and upgraded immediately to the latest security version.
The leak was targeted before it was released.
According to Amazon researchers, hackers tried to exploit the loopholes before they were made public. In its Wednesday report publish, the Amazon Threat Intelligence Service noted that an unidentified "threat actor " had obtained information in some way before the details of the loopholes were made public and had launched an attack on the Amazon sensor network used to track cybercrime activities, following which the company had detected several other attempts at exploitation.
The NCC Group intelligence and response to Vice-President Matt Hull stated that it was critical that the gap be understood as the window between the completion of the deployment of the patches and the need for prompt action by the affected agencies. "There is a real possibility that vulnerable systems have been invaded, including implanted into the back door," he said. "The potential impact cannot be minimized."
The Office of the Director General of the United States National Network is currently coordinating a joint response to the incident with the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency and the National Security Agency.
The impact covers 70% of the global interconnection. Network
PHP is one of the most widely deployed technologies on the Internet, supporting the operation of millions of websites and driving up to 70 per cent of the global Internet infrastructure.
Mainstream content management systems such as WordPress, Drupal, Joomla and Magento are supported by PHP. The network security company Huntress noted that PHP was also widely "invisible" within software even though the software did not publicly declare its use.
Any such underlying loophole, once exploited, may have a ripple effect in the Internet software supply chain, exposing online services to the risks of data theft, malicious software implantation and system leakage.
The temporary de-linking of the site is a routine defence against the use of loopholes by the attackers during the deployment of patches. The PHP development team had updated the publish software on Wednesday and urged users to implement it immediately.
AI Tool-Assisting Flows Discovery and Repair
This leak was discovered by Alphabet's network security company Wiz, using multiple artificial intelligence tools.
Wiz stated in the report that it had completed the study in cooperation with Open AI and Cybersecurity, Calif, and estimated that the loophole had existed for over a decade without detection.
"With the help of the front-line AI model and the appropriate tools, a researcher completed within a week what a world-class team had been doing for months." Wiz wrote in the report.
According to the company, the AI tool not only helped to quickly identify gaps but also accelerated the development of the rehabilitation programme, which played a key role in the emergency response.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.