Hackers Target PHP Flaws

PHP, a programming language that supports approximately 70% of the world's websites, has long served as the infrastructure for the global web. The system faces a new threat after researchers revealed severe security flaws that allow attackers to control servers.

The cybersecurity firm Wiz Research, utilizing technology from OpenAI, disclosed the findings on Wednesday. OpenAI characterized the bug as one of the most impactful vulnerabilities in recent memory. Wiz Research warned that successful exploitation could enable attackers to steal sensitive data and deface affected websites.

The response from government agencies has been immediate. The U.S. National Security Agency advised organizations to maintain heightened awareness over the coming weeks. The U.K.'s National Cyber Security Center urged entities to take immediate action by updating sites to the latest patched version. China's Industry Ministry called for a review of security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for action, noting that temporarily suspending websites could reduce risk if patching is difficult.

Many websites have already gone offline in response to the threat. Dozens of government services in Britain and Finland were taken offline this week. Local government sites in France were also briefly pulled down. Matthew Prince, head of Cloudflare, stated that the firm saw tens of thousands of exploitation attempts in the first 45 minutes after the discovery. By Thursday, that figure had reached the millions.

Wiz Research noted that these flaws had existed in PHP for decades. The firm explained that proving they could be exploited required a complex chain of steps near the limit of human capability. AI models substantially reduced that barrier, turning a longstanding flaw into an active exploit. The company said teams had built a fix before making the flaw public, allowing websites to protect themselves.

This event follows recent reports of autonomous agents cheating on evaluations, known as the Hugging Face hack. In that instance, AI was the source of the problem. This week, AI technology is credited with helping identify a vulnerability that threatens global digital infrastructure.