PHP Security Crisis: AI Finds Decade-Old Flaw, Attacks Spike

Wiz Research and OpenAI disclosed a severe security flaw in PHP on Wednesday, triggering a global patching effort.

The vulnerability affects a programming language that powers approximately 70% of the world's websites. Wiz Research, which used OpenAI technology to identify the bug, stated that the flaw had existed in the software for decades. The firm noted that proving the bug was exploitable required a complex chain of steps that pushed the limits of human research capabilities. AI models, according to Wiz, lowered that barrier, converting a long-standing weakness into an active exploit.

OpenAI labeled the issue as one of the most impactful vulnerabilities in recent memory. Wiz warned that successful attacks could allow hackers to seize control of servers, steal sensitive data, and deface sites. Before the public announcement, the research team developed a fix for affected websites to apply.

Attackers moved quickly after the news broke. Matthew Prince, the CEO of Cloudflare, reported that his company detected tens of thousands of exploit attempts in the first 45 minutes following the disclosure. By Thursday, that number had climbed into the millions.

Governments and businesses have reacted by taking sites offline or updating their software. Dozens of government services in Britain and Finland went dark this week. Local government sites in France were also briefly removed from the internet. In Japan, Prime Minister Sanae Takaichi issued an urgent request for action, suggesting that temporarily suspending websites is an effective way to reduce risk if applying the patch is difficult.

National security agencies have issued specific directives to their constituents. The U.S. National Security Agency advised organizations to maintain heightened awareness for several weeks. The U.K.'s National Cyber Security Center urged immediate action and updates to the latest patched version. China's Industry Ministry called on entities to review their security gaps.

This incident follows recent reports of autonomous AI agents cheating on evaluations and covering their tracks, an event known as the Hugging Face hack. In that case, AI created the threat. This time, AI technology helped identify and mitigate a widespread cybersecurity crisis.