UK Checks Websites for Exposure to Global PHP Security Flaw
Amazon says it was targeted before a warning was made public as governments urge rapid fixes
By AXY Tech Desk ·
Key points
- The UK government says it is working to identify and patch any potential exposure in its online services after vulnerabilities were found in PHP.
- Amazon says it identified a “PHP2Shell exploitation attempt” on 17 October, before an embargo on the warning was lifted, and was targeted again on 21 October.
- Details of the flaw were leaked on social media on Tuesday, ahead of the PHP Foundation’s planned release of a complete fix later this month.
- The NCSC, with counterparts in the EU and Australia, urged PHP users to apply fixes, and said systems could be taken offline where immediate remediation is not feasible.
The UK government said it is working to actively identify and patch any potential exposure in its online services after security weaknesses were found in PHP, the programming language behind a large share of the world’s websites. Governments and some of the world’s biggest companies, Amazon among them, were scrambling on Thursday to close the gaps before hackers could use them. Amazon says it was targeted before the warning was made public.
What PHP Is and Why Its Flaws Reach So Far
PHP is a programming language used to write the code that runs on the server hosting a website, rather than in a visitor’s browser. Many sites, from small blogs to large commercial platforms, are built with it. That is why a flaw in the language can matter well beyond the teams that chose to use it. A weakness in a widely shared tool can sit inside many separate websites at once, and the people who run those sites may not realise the tool is involved until a warning arrives.
That reach explains the urgency. For an attacker, a single flaw that works across many targets is far more valuable than one that affects a single website. For a website owner, the problem is that the fix has to be applied by each site, and some owners will not know whether their systems are affected at all.
The Warning and the Race to Patch
A “patch” is a software update that closes a security hole. Once a flaw is public, the clock starts. Users need to know the flaw exists, know which systems are affected, and install the fix before someone exploits it. Each of those steps takes time, and the gap between the warning and the fix is where attacks tend to land.
A UK government spokesperson urged “all organisations, private and public, large and small” to follow guidance to protect their systems. The message was aimed as much at small businesses and local services as at large institutions, because a flaw in a common language does not respect organisation size.
The UK’s National Cyber Security Centre (NCSC), the government body that advises on online defence, acted alongside its counterparts in the EU and Australia. They urged anyone using PHP to apply the fixes. Where a fix could not be applied straight away, the NCSC went further. “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,” the NCSC said in a note.
That advice is a hard one to follow. Taking a website offline stops it working for customers, readers or staff, so it is a step most owners would take only when the risk of leaving it running is greater than the cost of closing it. The NCSC’s guidance makes clear that its authorities regard the risk as serious enough to justify that cost.
Amazon Says It Was Attacked Before the Warning
Amazon announced on Wednesday that it had identified a “PHP2Shell exploitation attempt” that took place on 17 October. An exploitation attempt is when someone tries to use a known weakness to break into or take control of a system. The company said the attempt happened before an embargo on the warning was lifted. An embargo is an agreed hold on publishing information until a set time, and here it meant the public warning had not yet been released when the attack occurred.
In that first case, an anonymous internet address tried to target weaknesses in one of Amazon’s decoy systems. These are known as “honeypots”, systems deliberately set up to look like real targets so that attackers reveal their methods. Because the system was a decoy, Amazon was able to see the attempt without the attacker reaching anything that mattered. Amazon’s security chief, CJ Moses, said the use of an anonymous address suggests the activity was carried out by a “threat actor”, a term security teams use for the people or groups behind a malicious operation.
The timing is what worries security teams most. The PHP Foundation, the group that maintains the language, had planned to release its discovery later this month along with a complete fix. Details of the flaw were leaked on social media on Tuesday, before that release. Once the details were out, anyone could try to use them, while website owners had no official fix to install.
Amazon said it was unclear how the actors knew about the vulnerabilities before the embargo was lifted. That question is still open. It matters because a leak of technical details can move faster than a patch, and the people most at risk are often those who have not yet heard the news.
Why the Later Attacks Point to More Than One Group
Amazon reported further attacks on 21 October. Moses said that “the actual payloads and choices in anonymisation infrastructure varied, suggesting these were multiple actors.” A payload is the code an attacker sends to do harm once they get in. Anonymisation infrastructure is the set of tools, such as proxy networks, that attackers use to hide where their traffic comes from.
If the payloads and the hiding methods differ, the attacks probably did not come from one operation working from a single playbook. Several groups may have been probing the same weakness at the same time. That is a different threat from one determined attacker, because it means the window of exposure may have been shared by more than one party with different goals.
What Website Owners Should Do Now
The immediate test for any organisation is simple to state and harder to carry out. It needs to know whether it runs PHP, whether the affected versions are in use, and whether the fix has been applied. Where the answer is unclear, the NCSC’s advice to consider taking a system offline until it is fully mitigated gives a clear fallback.
The next milestone is the PHP Foundation’s planned release of a complete fix, which it had scheduled for later this month. Until that patch is out and installed, the risk remains, and the work of checking exposure will continue. The UK government says it is still working to identify and patch any potential exposure in its own online services, so the checks are not limited to private companies.
The broader lesson is about speed. A flaw in a language that underpins many websites can spread from the first discovery to live attacks within days. The organisations that come through best are likely to be those that already know where their software comes from, and can act on a warning without having to start the search from scratch.
The Open Questions
Several questions remain. The most pressing is how attackers learned of the flaw before the embargo lifted, a point Amazon says is unclear. The second is how many groups were involved in the later attacks, which Moses’s comments suggest was more than one. The third is how quickly organisations can apply the fix once the PHP Foundation releases it, and how many sites may stay exposed in the meantime.
For now, the advice from the UK government and its international counterparts is consistent. Find out whether your systems use PHP, apply the fixes as soon as they are available, and if a fix cannot be applied straight away, take the system offline until it can be fully mitigated.
Questions and answers
What is the PHP security flaw?
PHP is a programming language that underpins a significant number of the world’s websites. Vulnerabilities were identified in it, prompting governments and agencies to urge websites to apply fixes.
Has Amazon been attacked over the PHP flaw?
Yes. Amazon announced on Wednesday that it had identified a “PHP2Shell exploitation attempt” on 17 October, which it said occurred before an embargo on the warning was lifted. It said further attacks on 21 October appeared to involve multiple actors.
What should website owners do about the PHP vulnerability?
The NCSC urged anyone using PHP to apply the fixes. Where immediate remediation is not feasible, it said organisations should consider taking the system offline until it can be fully mitigated.
When will the complete PHP fix be released?
The PHP Foundation had planned to release its discovery later this month along with a complete fix. Details of the flaw were leaked on social media on Tuesday, before that release.
Topics: PHP, National Cyber Security Centre, Amazon, PHP Foundation, cyber security, website security, UK government
Sources: BBC Technology
https://axynewsglobal.com/article/uk-checks-websites-for-exposure-to-global-php-security-flaw