SANS raises cyber threat level for first time since 2021 — Fortune
In October, the SANS Internet Storm Center raised the cyber threat level for the first time since December 2021. According to the center’s own data, this was only the tenth time it had done so since 2010. Against this backdrop, government websites in Finland were taken offline, while the website of the Dutch parliament stopped working. In a comment to Fortune, Brian Ward, an associate professor of computer science at Vanderbilt University, linked the situation to PHP2Shell vulnerabilities.
PHP2Shell vulnerabilities
According to Ward’s assessment, the main cause was two vulnerabilities in PHP, a programming language used by about 70% of websites with a known programming language. These security flaws may allow attackers to take control of a web server.
Ward noted that a researcher working with an OpenAI model discovered vulnerabilities that had existed since at least 2012. PHP developers released fixes on October 21, but attacks were already underway. The U.S. National Security Agency and the UK National Cyber Security Centre urged organizations to disconnect systems that could not be patched immediately.
More current news is available on the UA.News Telegram channel Telegram.
Slow patch deployment
Qualys counted 167 million PHP installations in its customers’ systems. According to data cited by Ward, 12 hours after the disclosure of PHP2Shell, updates had been installed on about one in every thousand such systems. The author also noted that artificial intelligence systems can analyze patches to determine the vulnerability that was fixed and how to exploit it.
According to Ward’s calculations based on Media Cloud, during the eight days after information about PHP2Shell was disclosed on October 20, CNN, Fox News, NPR, and USA Today published 5,610 articles. Only nine of them mentioned this or other significant vulnerabilities that week, and two featured the topic in their headlines. The author called on the U.S. Cybersecurity and Infrastructure Security Agency to introduce public-friendly warnings about critical vulnerabilities and the start of attacks exploiting them.
