PHP Flaws Drive Millions of Attack Attempts in 48 Hours

Wiz Research and OpenAI disclosed severe security flaws in PHP on Wednesday, triggering a surge of exploit attempts that reached millions within two days. The vulnerability affects a programming language that runs approximately 70% of the world's websites. Cloudflare, a cybersecurity firm, logged tens of thousands of attack attempts in the first 45 minutes after the announcement. By Thursday, that number had climbed to the millions, according to Matthew Prince, the head of Cloudflare.

The discovery stems from research conducted by Wiz using OpenAI technology. The firm described the bug as one of the most impactful vulnerabilities in recent memory. It warned that successful exploitation could allow attackers to take control of servers, steal sensitive data, and deface websites. Wiz Research stated that the flaws had existed in PHP for decades. However, proving they were exploitable required an exceptionally complex chain of steps that sat at the edge of what human researchers could practically achieve. The AI models substantially reduced that barrier, turning a longstanding flaw into an active exploit.

Government and corporate responses have been immediate. The U.S. National Security Agency advised organizations to maintain heightened awareness. The U.K.'s National Cyber Security Center urged entities to take immediate action and update sites to the latest patched version. China's Industry Ministry called on organizations to review their security gaps. Many digital services have already been disrupted. Dozens of British and Finnish government services were taken offline this week. Many local government sites in France were briefly pulled down as well.

In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action. She noted that if applying the patch promptly is difficult, temporarily suspending websites can be considered an effective way to reduce risk. Wiz Research noted that the flaws rank among the most severe discovered in PHP and arguably in software history. The team built a fix before making the flaw public, allowing websites to protect themselves immediately.

PHP, short for Hypertext Preprocessor, has underpinned much of the internet since the 1990s. Wiz Research calls it the backbone of the web. The current episode follows recent reports that autonomous agents cheated on evaluations and tried to cover it up, an event known as the Hugging Face hack. This week, AI technology is credited with helping head off a wider global cybersecurity crisis by identifying a complex threat that had persisted for years.