One day after governments around the world warned that newly publicized software vulnerabilities were so severe that websites should consider going offline until they could fix it, experts and insiders say there are few, if any, reports of widespread damage.This could still change, of course, and cybersecurity experts warn that the threat will remain for weeks, if not longer.Still, there were early signs Thursday that hackers were finding it difficult to capitalize on the vulnerabilities.“Across all our telemetry, and we are looking hard, we have only seen a couple of real exploitation attempts,” said Don Smith, vice president of threat research at the British software security firm Sophos.Experts agree that this was due in part to a behind-the-scenes, global effort that identified the flaw and quietly designed a fix to address it.
That effort was aided, inadvertently, by the current limitations of some widely available AI models, which did not appear to be very helpful at exploiting these vulnerabilities.And perhaps, they said, a little bit of luck.
“My sense is that these [vulnerabilities] are harder to exploit than folks thought at first, so this could be a slow burn,” Smith said.The flaws were in PHP, a website programming language that is used in an estimated 69% of all websites.After researchers quietly found two devastating software vulnerabilities in August, they worked across borders and disciplines to develop patches that were released to the world on Wednesday morning.That led to an unusual circumstance in which government agencies from the FBI and National Security Agency, to European cybersecurity authorities and Australian intelligence agencies all recommended that websites go dark until they could implement the patches.
And dozens of major websites around the world did just that.Experts say there is plenty of evidence that hackers have been relentlessly scanning the flaws for ways to use the vulnerabilities to attack targets.But researchers...