PHP Vulnerability Exploited Before Disclosure; Governments, Banks Take Sites Offline to Patch

Amazon (AMZN) security researchers said two vulnerabilities in PHP, the programming language underpinning millions of websites and software platforms, were probed by hackers days before public disclosure. After the flaws were disclosed on Wednesday, governments, banks and companies in multiple countries took sites and online services offline to install patches. The PHP maintenance team has released updates and urged immediate patching. Amazon's threat intelligence team said it detected exploitation attempts on October 17 in honeypots used to track cybercrime; an unidentified attacker appeared to have advance information, though how it was obtained remains unclear. Exploitation widened after disclosure. NCC Group's Matt Hull warned the window between disclosure and patching is critical, with some systems possibly already breached or backdoored. Orange halted some French sites and apps on Thursday. Mizuho's (MFG) banking and securities units and MUFG (MUFG) companies disabled some services; Shizuoka Bank suspended its website and apps, and a Japanese airline also disabled services. U.K., French, German, Dutch, Australian and Canadian government bodies took sites down. The U.S. Office of the National Cyber Director is coordinating with the FBI, CISA and NSA. Palo Alto Networks (PANW) said it found more than 22.6 million exposed vulnerable instances. Wiz, owned by Alphabet (GOOGL), estimated about 70% of the internet is affected and said the flaw lay hidden for over a decade.