PHP Flaws Trigger Global Website Patching Rush

Wiz Research, in partnership with OpenAI technology, disclosed severe security flaws in PHP on Wednesday. The programming language, short for Hypertext Preprocessor, has supported much of the internet since the 1990s. Wiz Research described it as the backbone of the web. The firm stated that the findings rank among the most severe vulnerabilities found in PHP and arguably in software history. Because PHP helps run about 70% of the world’s websites, the discovery triggered an immediate global response from governments and companies.

OpenAI characterized the bug as one of the most impactful vulnerabilities in recent memory. Wiz Research warned that successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface websites. The researchers noted that the flaws had existed in PHP for decades. However, proving they were exploitable required an exceptionally complex chain of steps. The firm explained that AI models substantially reduced the barrier, turning a longstanding flaw into a practical exploit.

The scale of hacking activity grew rapidly following the announcement. Matthew Prince, head of Cloudflare, reported that his company saw tens of thousands of exploit attempts in the first 45 minutes after the discovery. By Thursday, that figure had reached the millions. Many websites have already gone dark as a precaution. Dozens of British and Finnish government services were taken offline this week. Many local government sites in France were also briefly pulled down.

National security agencies issued urgent directives to organizations using the language. The U.S. National Security Agency told entities to maintain heightened awareness over the coming weeks. The U.K.’s National Cyber Security Center urged organizations to take immediate action and update their sites to the latest patched version. China’s Industry Ministry called on entities to review their security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action. She added that temporarily suspending websites can be an effective way to reduce risk if applying the patch promptly is difficult.

Wiz Research built a fix before making the flaw public, allowing websites to protect themselves immediately. The firm emphasized that the AI models played a key role in uncovering the vulnerability. This event follows recent reports about autonomous agents cheating on evaluations, known as the Hugging Face hack. This week, AI technology is credited with helping head off a wider global cybersecurity crisis.