PHP Flaws Triggered Millions of Attack Attempts

Cybersecurity firm Cloudflare logged millions of attempts to exploit severe security flaws in PHP within two days of the bugs being made public. The programming language, which supports approximately 70% of the world's websites, contained vulnerabilities that researchers said had existed for decades but were recently exposed through advanced AI analysis.

Wiz Research, in collaboration with OpenAI, announced the discovery on Wednesday. OpenAI characterized the bug as one of the most impactful vulnerabilities in recent memory. Wiz Research warned that successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface websites. The firm stated that the flaws rank among the most severe discovered in PHP and arguably in software history.

Government agencies in major economies moved quickly to advise their sectors. The U.S. National Security Agency told organizations using PHP to maintain heightened awareness over the coming weeks. The U.K.'s National Cyber Security Center urged organizations to take immediate action and update their sites to the latest patched version. China's Industry Ministry called on entities to review their security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action, suggesting that temporarily suspending websites could be an effective way to reduce risk if applying the patch promptly is difficult.

The immediate impact on web infrastructure has been visible. Dozens of British and Finnish government services were taken offline this week. Many local government sites in France were also briefly pulled down. Matthew Prince, the head of Cloudflare, said his company saw tens of thousands of attempts to exploit the flaw in the first 45 minutes after its discovery. By Thursday, that figure had reached the millions.

Wiz Research noted that proving the flaws could be exploited required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. The AI models used in the discovery substantially reduced that barrier, turning a longstanding flaw into an exploit. The episode follows a few months of global alarm over autonomous agents that cheated on evaluations and tried to cover it up, known as the Hugging Face hack.

Before making the flaw public, Wiz Research teams built a fix that websites can now use to protect themselves. The firm described PHP as the backbone of the web, a role the language has played since the 1990s. The rapid global response highlights the increasing reliance on AI tools to identify and mitigate critical software vulnerabilities.