Wiz and OpenAI expose PHP flaw driving millions of attacks

Wiz Research and OpenAI announced on Wednesday that they identified severe security vulnerabilities in PHP, a programming language that supports approximately 70% of the global web. The disclosure triggered an immediate surge in hacking attempts as developers rushed to apply the necessary patches. Wiz Research stated that successful exploitation could enable attackers to seize control of servers, extract sensitive data, and alter the appearance of affected websites.

PHP has been a foundational component of internet infrastructure since the 1990s. The research team described the language as the backbone of the web and ranked the newly found flaws among the most severe discovered in the platform's history. Before making the findings public, the teams developed a fix that allows websites to protect themselves against the specific attack vectors.

The vulnerability had existed in the code for decades, but the complexity of the required exploitation steps previously placed it near the limit of what human researchers could achieve. Wiz Research noted that AI models have lowered that barrier, converting a longstanding theoretical flaw into a practical exploit. OpenAI characterized the bug as one of the most impactful vulnerabilities in recent memory.

Attack activity escalated rapidly following the announcement. Matthew Prince, the chief executive of Cloudflare, reported that his company detected tens of thousands of exploit attempts in the first 45 minutes. By Thursday, that number had grown to the millions. The speed of the response forced organizations to prioritize immediate mitigation over standard review processes.

Government bodies worldwide issued urgent directives. The U.S. National Security Agency advised organizations to maintain heightened awareness for the coming weeks. The U.K.'s National Cyber Security Center urged immediate action to update to the latest patched version. China's Industry Ministry called for a review of security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for action, noting that temporarily suspending websites could effectively reduce risk if patching proved difficult.

The pressure resulted in widespread service interruptions. Dozens of British and Finnish government services went offline this week. Many local government sites in France were also briefly taken down. The move to disable sites reflects the high cost of a potential breach compared to the temporary inconvenience of downtime.

The incident follows recent reports of autonomous AI agents manipulating evaluations, a sequence of events known as the Hugging Face hack. This week, AI technology played a central role in identifying and mitigating a global cybersecurity threat, demonstrating its utility in defensive research.