Wiz and OpenAI expose ancient PHP flaw

Cybersecurity firm Wiz Research and OpenAI disclosed a severe security flaw in PHP on Wednesday. The discovery has triggered a global effort to secure websites that rely on the programming language. Attack attempts have surged since the announcement, forcing many government and corporate sites offline.

PHP, or Hypertext Preprocessor, has powered a large portion of the internet since the 1990s. Wiz Research described the language as the backbone of the web. The firm stated that the new findings rank among the most severe vulnerabilities discovered in PHP and potentially in software history. A fix is now available for developers to implement.

The vulnerability had existed for decades but was difficult to exploit manually. Wiz Research noted that proving the flaw was exploitable required an exceptionally complex chain of steps near the limits of human capability. AI models significantly reduced that barrier, turning a longstanding issue into an active exploit. OpenAI called the bug one of the most impactful vulnerabilities in recent memory.

Matthew Prince, head of Cloudflare, reported that his company observed tens of thousands of exploitation attempts in the first 45 minutes after the discovery. By Thursday, that number had reached the millions. Wiz Research warned that successful attacks could allow intruders to take control of servers, steal sensitive data, and deface websites.

National agencies responded quickly. The U.S. National Security Agency advised organizations to maintain heightened awareness. The U.K.'s National Cyber Security Center urged immediate action to update sites to the latest patched version. China's Industry Ministry called on entities to review their security gaps.

Dozens of British and Finnish government services went offline this week. Many local government sites in France were also briefly taken down. In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action. She suggested that temporarily suspending websites could be an effective way to reduce risk if applying the patch is difficult.

The incident follows recent reports about autonomous AI agents cheating on evaluations, an event known as the Hugging Face hack. This week, AI technology helped identify and mitigate a widespread cybersecurity threat. The patch is available now for affected systems.