Recently The New York Times reported the following:
What Is PHP? Why Are Government and Business Websites
Going Offline? (2/2)
A critical security flaw in the programming language
underpinning much of the web has prompted a global rush to patch vulnerable
systems.
By Karla Adam and Dustin Volz (Aaron Krolik contributed
reporting)
Oct. 22, 2026
(continue)
Have attacks already started?
The defenders and hackers began racing to protect or
compromise systems on Wednesday when the patch was released. But there were
signs of an earlier leak from the group of security researchers working to
create the fix.
Late Wednesday, Amazon revealed in a blog post that it had
data showing that an unknown actor had attempted to use the PHP attack four
days before the patch’s release against a honeypot network, or a decoy system,
that the company maintains. (A honeypot network tries to catch cybercriminals
in the act of doing something nefarious.)
The identity of the attacker was unknown, but the early
activity suggested that hackers could have been readying attacks for days
before a fix was released.
“It remains unclear how the actor acquired exploit
information prior to disclosure,” C.J. Moses, the chief information security
officer at Amazon, said in the blog post.
Which sites are affected?
Sites that rely on PHP are vulnerable, which means a good
chunk of the internet.
Matthew Prince, the chief executive of CloudFlare, which
helps websites secure and manage internet traffic, said in a social media post
on Wednesday that the company “saw thousands of attempts to exploit” the flaw
in the hours before it was publicly announced.
“That jumped to tens of thousands in the 45 minutes post
announcement, hundreds of thousands within 2 hours, and millions now,” Mr.
Prince added.
Several government websites in Europe and Asia went offline
as a precautionary measure.
The Dutch cybersecurity agency, Internet Archive and the
operator of Wikipedia took down a number of its systems. In Britain, the prime
minister’s office said some government services might be offline on Friday.
On Thursday morning, the website of Finland’s government
displayed a message to users: “The websites of the government are fully or
partially unavailable. We are currently resolving the issue. Please try again
in a moment.”
Prime Minister Sanae Takaichi of Japan urged operators whose
sites rely on PHP to apply the patch as soon as possible. For those unable to
do so immediately, she wrote on social media, temporarily suspending websites
and similar measures could be effective in reducing risk.
Should regular internet users be concerned?
Because PHP is so pervasive, the collateral damage could
fall on everyday users whose personal data and essential online services depend
on sites staying secure. Consumers could experience online disruptions in the
coming days with certain businesses or government services.
Translation
什麼是 PHP?為什麼政府和企業網站會紛紛下線? (2/2)
支撐大部分網路運行的程式語言
PHP 存在一個嚴重的安全漏洞,這引發了全球修復漏洞系統的熱潮
(繼續)
攻擊已經開始了嗎?
週三修補通知發佈後,防禦者和駭客開始爭分奪秒地保護或攻破系統。但有跡象表明,參與修復的安全研究人員團隊中先前已經有出現早期洩露的跡象。
在週三較晚的時候,亞馬遜在一篇部落格文章中透露,數據顯示,在修補程式發佈前四天,一名身份不明的攻擊者曾試圖利用
PHP 漏洞攻擊該公司維護的蜜罐網路 (honeypot network)(或稱誘餌系統)。 (蜜罐網路旨在抓獲正在進行惡意活動的網絡犯罪者。)
攻擊者的身份尚不清楚,但早期活動表明,駭客可能在漏洞修復程序發佈前數日就開始準備攻擊。
亞馬遜首席資訊安全官
C.J. Moses 在部落格文章中表示:“目前尚不清楚攻擊者是如何在漏洞披露前獲取可利用的資訊。”
哪些網站受到影響?
依賴 PHP 的網站都存在漏洞,這意味著網絡的很大一部分都受到了影響。
CloudFlare 執行長
Matthew Prince 週三在社交媒體上發文稱,該公司在漏洞公開披露前的幾個小時內「發現了數千次利用漏洞的嘗試」。
CloudFlare 是一家幫助網站保護和管理網絡流量的公司。
Prince 補充說: “在公告發布後的 45 分鐘內,嘗試次數激增至數萬次;2 小時內達到數十萬次;現在已達數百萬次。”
作為預防措施,歐洲和亞洲的多個政府網站已暫時下線。
荷蘭網絡安全機構、網絡檔案館和維基百科的營運商關閉了多個系統。在英國,首相辦公室表示,部分政府服務可能在周五離線。
週四上午,芬蘭政府網站向用戶顯示訊息:“政府網站全部或部分無法進入。我們正在解決問題,請稍後再試。”
日本首相高市早苗敦促依賴 PHP 的網站營運商盡快應用補救。她在社交媒體上表示,對於無法立即進行補救的營運商,暫時關閉網站等措施可以有效降低風險。
普通網友是否該擔心?
由於
PHP 應用廣泛,其帶來的附帶損害可能會波及日常用戶,用戶的個人資料和重要的線上服務都依賴網站的安全。未來幾天,消費者在使用某些企業或政府服務時可能會遇到網絡中斷的情況。
So, governments and companies around the world
are racing to patch their websites — or taking them offline until they can be
fixed — after the discovery of major security flaws in PHP, a piece of software
that underpins much of the internet. Many websites are taken down as a
protective measure. It is interesting to know that the chief executive of
CloudFlare has said that the company “saw thousands of attempts to exploit”
the flaw in the hours before it was publicly announced. Apparently, cybercriminals
are everywhere.