Hackers already attempting to exploit PHP vulnerabilities to breach servers
Authorities in several countries advise disabling their systems
Google, OpenAI, and Amazon have joined the analysis of threats, search for attacks, and protection of systems. Google used artificial intelligence models to study the vulnerabilities, assess their severity, simulate attacks, and test patches. OpenAI stated that critical issues were discovered by researchers working with its AI models, but cybercriminals could exploit the same capabilities.
Amazon reported that its MadPot monitoring system detected exploitation attempts as early as October 17—before the public disclosure of the issue. Cloudflare also recorded such activities a day before the official announcement and activated web application firewalls.
VulnCheck detected connections to vulnerable systems set up for observation from IP addresses in Canada and the Netherlands. At least one exploitation attempt, which allowed executing code without authentication, originated from an address registered in China; the attacker requested a non-existent path and received a 404 error.
According to Patchstack, after the release of the PHP update, telemetry showed only probing, with no direct evidence of breaches. Some websites temporarily suspended operations, including Pinboard, several Dutch government resources, and certain services linked to Wikipedia.
