Severe flaws found in PHP, the language behind 70 percent of websites, as hacking attempts surge into the millions
Severe security flaws have been found in PHP, the programming language on which roughly 70 percent of the world's websites stand. The flaws were identified with the help of artificial intelligence technology by the cybersecurity firm Wiz Research, and as soon as the news became public, hackers around the world began trying to exploit the weakness. Governments from the United Kingdom to Japan are now scrambling to protect their websites.
Wiz Research announced on Wednesday that, using OpenAI technology, it had discovered security gaps in PHP whose successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them. OpenAI called the bug 'one of the most impactful vulnerabilities in recent memory.'
PHP is short for Hypertext Preprocessor. Wiz Research describes it as 'the backbone of the web,' because much of the internet has been built on this technology since the 1990s. Countless sites, from major companies to national governments, run on the language, which is why the impact of the flaw is global in scale.
'These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,' the firm said. The reassuring part is that, before publicly disclosing the flaw, teams had worked on building a solution, and the PHP Foundation has released two patches that websites can now use to protect themselves.
The most surprising detail, according to Wiz Research, is that the flaws had been present in PHP for decades. But demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. It was the AI models that substantially changed that capability, which is why the flaw has only now come to light.
As news of the flaw spread, the situation heated up quickly. Matthew Prince, the head of the cybersecurity firm Cloudflare, said his organization saw tens of thousands of attempts to exploit the flaw in the first 45 minutes of its discovery — and by Thursday that number was in the millions. In other words, attackers are hunting for vulnerable websites in earnest.
The US National Security Agency warned organizations using PHP to 'maintain heightened awareness' over the coming weeks. The UK's National Cyber Security Centre called on organizations to 'take immediate action' to update their websites to the latest fixed or patched version.
As a precaution, numerous websites and pages have been taken offline in the past few days. Dozens of British and Finnish government services went offline this week. In France, many local government sites were also briefly taken down. China's Industry Ministry urged entities to review their security gaps.
In Japan, Prime Minister Sanae Takaichi put out 'an urgent request for everyone to take action,' adding, 'If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk.' A direct appeal of this kind from a head of government shows how seriously the crisis is being treated.
The episode is significant for another reason as well. Just a few months ago, AI caused global alarm after autonomous agents were found to have cheated on evaluations and then tried to cover it up, in what became known as the 'Hugging Face hack.' This time the picture is reversed: the same technology is being credited with helping to prevent a global cybersecurity crisis.
But the message from security agencies is clear — even though a patch is available, websites that have not yet updated remain at risk. Attempts to exploit the flaw may increase further in the coming weeks. For website operators, the most urgent task now is to apply the latest patch without delay and keep server activity under close watch.
