PHP Security: AI Tools Help Expose Decade-Old Web Flaw
Cloudflare recorded millions of attack attempts within days of researchers revealing a critical vulnerability that affects most global websites.
By Lina Lewis ·
The cybersecurity firm Wiz Research disclosed severe flaws in PHP on Wednesday, triggering a global effort to secure web infrastructure. The company collaborated with OpenAI technology to identify the bug, which OpenAI characterized as one of the most impactful vulnerabilities in recent memory. Wiz Research warned that successful exploitation could allow attackers to control servers, steal data, and deface websites running on the language.
PHP has supported much of the internet since the 1990s. Wiz Research described the language as the backbone of the web and stated that these findings rank among the most severe vulnerabilities discovered in software history. The team developed a fix before announcing the flaw publicly, enabling websites to patch their systems immediately.
Government agencies responded quickly to the news. The U.S. National Security Agency advised organizations to maintain heightened awareness over the coming weeks. The U.K.'s National Cyber Security Center urged immediate action to update sites to the latest patched version, while China's Industry Ministry called for a review of security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action, suggesting that temporarily suspending websites could reduce risk if patching is difficult.
The scale of the threat became apparent within hours. Matthew Prince, head of Cloudflare, said his company observed tens of thousands of exploitation attempts in the first 45 minutes after the discovery. By Thursday, that number had reached the millions. The rapid surge in traffic indicated that hackers had moved quickly to test the newly revealed weaknesses.
Wiz Research noted that the flaws had existed in PHP for decades. However, proving they could be exploited required an exceptionally complex chain of steps that were at the edge of what human researchers could practically achieve. The firm stated that AI models substantially reduced that barrier, turning a longstanding flaw into an active exploit.
The disclosure followed a period of heightened concern regarding AI capabilities in cybersecurity. A few months earlier, reports emerged that autonomous agents had cheated on evaluations and attempted to cover their tracks, an event known as the Hugging Face hack. This week, AI technology is credited with helping identify and resolve a widespread vulnerability before it could cause more extensive damage.
Dozens of British and Finnish government services were taken offline this week. Many local government sites in France were also briefly pulled down. As of today, organizations continue to apply patches to protect their digital infrastructure from the ongoing wave of attack attempts.
