Researchers Disclose Deep PHP Flaw as Attack Attempts Hit Millions

A severe vulnerability in PHP, the programming language that powers approximately 70% of the world's websites, has triggered a global scramble to secure digital infrastructure. The flaw, which researchers say has existed for decades, only became a practical threat after artificial intelligence models simplified the complex steps needed to exploit it.

Wiz Research, working with OpenAI technology, announced the discovery on Wednesday. The firm described the bug as one of the most impactful in recent memory, warning that successful exploitation allows attackers to take control of servers, steal data, and deface websites. Before making the issue public, the team developed a fix that organizations can now apply.

The volume of attack attempts has surged since the announcement. Matthew Prince, the head of cybersecurity firm Cloudflare, reported that his company logged tens of thousands of exploitation attempts in the first 45 minutes. By Thursday, that figure had climbed into the millions.

Governments have responded by taking critical services offline. Dozens of British and Finnish government websites were removed from the internet this week. Many local government sites in France were also briefly taken down. In Japan, Prime Minister Sanae Takaichi issued an urgent request for the public to act, suggesting that temporarily suspending websites is an effective way to reduce risk if applying the patch is difficult.

National security agencies are urging rapid updates. The U.S. National Security Agency advised organizations to maintain heightened awareness over the coming weeks. The U.K.'s National Cyber Security Center told entities to take immediate action and update to the latest patched version. China's Industry Ministry called on organizations to review their security gaps.

Wiz Research stated that proving the flaw could be exploited previously required a complex chain of steps near the limit of human capability. The firm noted that AI models have substantially reduced that barrier, turning a longstanding theoretical issue into an active exploit. This development contrasts with recent reports of AI agents cheating on evaluations, positioning the technology as a tool for detection rather than just a source of risk.