One day after governments around the world warned that newly publicized software vulnerabilities were so severe that websites should consider going offline until they could fix them, experts and insiders said there are few, if any, reports of widespread damage.
That could still change, of course, and cybersecurity experts warn that the threat will remain for weeks, if not longer. Still, there were early signs Thursday that hackers were finding it difficult to capitalize on the vulnerabilities.
“Across all our telemetry, and we are looking hard, we have only seen a couple of real exploitation attempts,” said Don Smith, vice president of threat research at the British software security firm Sophos.
Experts agree that that was in part because of a behind-the-scenes, global effort that identified the flaw and quietly designed a fix to address it.
The effort was aided, inadvertently, by the current limits of some widely available AI models, which did not appear to be very helpful at exploiting the vulnerabilities. And perhaps, they said, a little bit of luck.
“My sense is that these [vulnerabilities] are harder to exploit than folks thought at first, so this could be a slow burn,” Smith said.
The flaws were in PHP, a website programming language that is used in an estimated 69% of all websites. After researchers quietly found two devastating software vulnerabilities in August, they worked across borders and disciplines to develop patches that were released to the world Wednesday morning.
That led to an unusual circumstance in which government agencies from the FBI and the National Security Agency to European cybersecurity authorities and Australian intelligence agencies all recommended that websites go dark until they could implement the patches. And dozens of major websites around the world did just that.
Experts say there is plenty of evidence that hackers have been relentlessly scanning the flaws for ways to use them to attack targets.
But researchers and spokespeople from nine industry-leading companies — CrowdStrike, ESET, Google Threat Intelligence Group, Huntress, Palo Alto Networks, Recorded Future, SecureWorks, Sophos and Trail of Bits — told NBC News that as of Thursday evening, they had not seen any successful attacks.
“We have not yet seen these PHP vulnerabilities exploited in the wild yet,” said Sherrod DeGrippo, vice president of threat intelligence at Palo Alto Networks’ Unit 42.
“We have seen over 200 examples of proofs-of-concept exploit code, and we’re actively investigating them all,” she said, referring to programs that claimed they could exploit the PHP flaws. “Whether or not there are current, active exploits is only a matter of time.”
While the vulnerability itself was devastating in theory, it was also technically very difficult to hack, said Dan Guido, CEO of the cybersecurity research and consulting firm Trail of Bits.
Guido said it took one of his employees, a 10-year veteran, an entire day to hack the vulnerabilities with an advanced AI model.
Amazon Web Services said it used honeypots — fake websites that cybersecurity researchers set up to trick and monitor hackers — to find evidence that hackers were trying to exploit the PHP vulnerability at least four days before it was made public.
“Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems,” the company said in a blog post.
Matthew Prince, the CEO of Cloudflare, one of the internet’s most popular hosting companies, said that the company had been in talks for months about how to patch the flaw and that none of his customers were affected.
“The scary thing here is that something could have gotten compromised very quietly,” he said. “There may not be any public evidence that the server was compromised, and the hacker could just be hanging out there.”
While dormant intruders are always a potential threat in any hacking scenario, Guido, of Trail of Bits, said it was important to keep in mind that it takes more than just an experimental code and a little luck to hack a sophisticated web property.
That is especially true for hackers who rely on open-weight AI models — ones they can tinker with and remove guardrails from to assist with their operations.
Those models are not as powerful as those available to front-line cybersecurity researchers — and they typically struggle with complicated vulnerabilities like the PHP flaws.
“A lot of people are confusing proof of concept with exploit,” he said. “Turns out that writing exploits still requires expertise. You can’t just fake it.”
