One day after governments around the world warned that newly publicized software vulnerabilities were so severe that websites should consider going offline until they could fix it, experts and insiders say there are few, if any, reports of widespread damage.
uncertain
experts → warn → damage
This could still change, of course, and cybersecurity experts warn that the threat will remain for weeks, if not longer.
uncertain
threat → change → weeks
Still, there were early signs Thursday that hackers were finding it difficult to capitalize on the vulnerabilities.
asserted
it → be → vulnerabilities
“Across all our telemetry, and we are looking hard, we have only seen a couple of real exploitation attempts,” said Don Smith, vice president of threat research at the British software security firm Sophos.
asserted
Smith → look → firm
Experts agree that this was due in part to a behind-the-scenes, global effort that identified the flaw and quietly designed a fix to address it.
asserted
that → agree → it
That effort was aided, inadvertently, by the current limitations of some widely available AI models, which did not appear to be very helpful at exploiting these vulnerabilities.
asserted
which → aid → vulnerabilities
And perhaps, they said, a little bit of luck.
asserted
they → say → luck
“My sense is that these [vulnerabilities] are harder to exploit than folks thought at first, so this could be a slow burn,” Smith said.
uncertain
Smith → exploit → ?
The flaws were in PHP, a website programming language that is used in an estimated 69% of all websites.
asserted
that → use → websites
After researchers quietly found two devastating software vulnerabilities in August, they worked across borders and disciplines to develop patches that were released to the world on Wednesday morning.
asserted
that → find → morning
That led to an unusual circumstance in which government agencies from the FBI and National Security Agency, to European cybersecurity authorities and Australian intelligence agencies all recommended that websites go dark until they could implement the patches.
uncertain
they → lead → patches
And dozens of major websites around the world did just that.
asserted
dozens → do → that
Experts say there is plenty of evidence that hackers have been relentlessly scanning the flaws for ways to use the vulnerabilities to attack targets.
asserted
hackers → say → targets
But researchers and spokespeople from nine industry leading companies — CrowdStrike, ESET, Google Threat Intelligence Group, Huntress, Palo Alto Networks, Recorded Future, SecureWorks, Sophos and Trail of Bits — told NBC News that as of Thursday evening, they had not seen any successful attacks.
asserted
they → lead → attacks
“We have not yet seen these PHP vulnerabilities exploited in the wild yet,” said Sherrod DeGrippo, vice president of threat intelligence at Palo Alto Networks’ Unit 42.
asserted
DeGrippo → see → Unit
“We have seen over 200 examples of proofs of concept exploit code, and we’re actively investigating them all,” she said, referring to programs that claimed they could exploit the PHP flaws.
uncertain
they → see → flaws
“Whether or not there are current, active exploits, is only a matter of time.
asserted
are → be → time
While the vulnerability itself was devastating in theory, it was also technically very difficult to hack, said Dan Guido, CEO of the cybersecurity research and consulting firm Trail of Bits.
asserted
Guido → hack → Bits
Guido said it took one of his employees, a 10-year veteran, an entire day to hack the vulnerabilities with an advanced AI model.
asserted
it → say → model
Amazon Web Services said it had used honeypots — fake websites that cybersecurity researchers set up to trick and monitor hackers — to find evidence that hackers were trying to exploit the PHP vulnerability at least four days before it was made public.
asserted
it → say → vulnerability
“Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems,” the company said in a blog post.
uncertain
company → ’ → post
Matthew Prince, the CEO of Cloudflare, one of the internet’s most popular hosting companies, said the company had been in talks for months about how to patch the flaw, and that none of his customers were affected.
asserted
none → host → customers
“The scary thing here is that something could have gotten compromised very quietly,” said Prince.
uncertain
Prince → compromise → ?
“There may not be any public evidence that the server was compromised, and the hacker could just be hanging out there.
uncertain
hacker → compromise → ?
While dormant intruders are always a potential threat in any hacking scenario, Guido, of Trail of Bits, said it was important to keep in mind that it takes more than just an experimental code and a little luck to hack a sophisticated web property.
asserted
it → say → property
This is especially true for hackers who rely on open-weight AI models — ones that they can tinker with and remove guardrails from to assist with their operations.
asserted
they → rely → operations
These models are not as powerful as those available to frontline cybersecurity researchers — and they typically struggle with complicated vulnerabilities like the PHP flaws.
asserted
they → struggle → flaws
“A lot of people are confusing proof of concept with exploit,” he said.
asserted
he → confuse → exploit
“Turns out that writing exploits still requires expertise.
asserted
writing → turn → expertise
You can’t just fake it.”
asserted
You → fake → it
The Aporia
