PHP Flaws Targeted Before Disclosure, 22.6 Million Exposed Instances

Two PHP security flaws were targeted before public disclosure, creating potential risk for crypto services and other systems running affected software as exploitation widened after the flaws became public Wednesday, Oct. 21.

Amazon's threat intelligence team detected attempts to exploit the vulnerabilities Saturday, Oct. 17, four days before disclosure. Exploitation widened after disclosure, and no specific victims were disclosed.

More than 22.6 million internet-exposed instances had the flaws. The vulnerabilities could affect about 70% of the internet. Those figures describe potential exposure and reach, not a confirmed count of compromised systems.

NCC Group Vice President Matt Hull warned that some vulnerable systems may already have been compromised and could contain backdoors. The vulnerability had existed for more than a decade, meaning the risk may involve long-standing PHP installations. The figures do not establish how many systems were breached.