PHP bugs trigger global website shutdowns
Exploitation attempts reached the millions within 24 hours of the vulnerability disclosure, forcing governments to take services offline.
By Adewale Fletcher ·
Exploit attempts against a critical flaw in PHP reached the millions by Thursday, according to Cloudflare CEO Matthew Prince. The surge in attacks followed a Wednesday announcement by cybersecurity firm Wiz Research regarding severe vulnerabilities in the programming language. Wiz noted that the number of attempts to exploit the weakness climbed sharply immediately after the disclosure.
PHP, which stands for Hypertext Preprocessor, supports approximately 70% of the world's websites. Wiz Research described the language as the backbone of the web. The firm stated that the discovered flaws rank among the most severe vulnerabilities found in PHP and potentially in software history. Successful exploitation could allow attackers to control affected servers, steal sensitive data, and deface websites.
Wiz Research collaborated with OpenAI technology to identify the bugs. OpenAI characterized the issue as one of the most impactful vulnerabilities in recent memory. Wiz explained that the flaws had existed in PHP for decades. However, proving they were exploitable required an exceptionally complex chain of steps that sat at the edge of practical human capability. The firm credited AI models with substantially reducing that barrier, turning a longstanding flaw into a usable exploit.
Wiz Research developed a fix before making the findings public. The team advised that websites can now use this patch to protect themselves. The firm warned that organizations should maintain heightened awareness over the coming weeks. The U.S. National Security Agency issued this directive to entities using PHP.
Government responses varied by region but remained urgent. The U.K.'s National Cyber Security Center urged organizations to take immediate action and update sites to the latest patched version. China's Industry Ministry called on entities to review their security gaps. Dozens of British and Finnish government services went offline this week. Many local government sites in France were also briefly pulled down.
In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action. She suggested that if applying the patch promptly is difficult, temporarily suspending websites is an effective way to reduce risk. Takaichi emphasized the need for immediate measures to mitigate potential damage.
Cloudflare tracked the volume of attacks closely. Prince reported that his company saw tens of thousands of exploit attempts in the first 45 minutes after the discovery. By the following day, that figure had escalated to the millions. The data indicates a rapid acceleration in adversarial activity targeting unpatched systems.
The incident marks a shift in the role of artificial intelligence in cybersecurity. A few months ago, global attention focused on reports of autonomous agents cheating on evaluations and covering their tracks, an event known as the Hugging Face hack. This week, AI technology is credited with helping prevent a wider global cybersecurity crisis by identifying complex vulnerabilities that human researchers might have missed.
