Exploitation attempts spike as developers patch critical PHP flaws
Cloudflare reports millions of attack attempts since the vulnerability disclosure, prompting government agencies in the U.S., U.K., and Japan to urge immediate updates.
By Hassan Lawson ·
Attack attempts against websites running on PHP surged to millions within 24 hours of a critical security disclosure.
Wiz Research revealed the flaws on Wednesday, noting that OpenAI technology helped identify weaknesses present in the code for decades. The firm stated that successful exploitation could allow attackers to seize control of servers, steal data, and deface sites. OpenAI labeled the bug one of the most impactful vulnerabilities in recent memory.
PHP, or Hypertext Preprocessor, supports approximately 70% of global websites. The language has powered the internet since the 1990s. Wiz Research described it as the backbone of the web and ranked the new findings among the most severe in software history. The team developed a fix before making the issue public, allowing site operators to apply patches immediately.
Government agencies responded quickly to the threat. The U.S. National Security Agency advised organizations to maintain heightened awareness over the coming weeks. The U.K. National Cyber Security Center urged entities to take immediate action and update to the latest patched version. China's Industry Ministry called on organizations to review security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action. She noted that temporarily suspending websites is an effective way to reduce risk if applying the patch is difficult.
Several public services have already gone offline. Dozens of government services in Britain and Finland were taken down this week. Many local government sites in France were briefly pulled from the internet as well.
Matthew Prince, head of Cloudflare, said the company observed tens of thousands of exploit attempts in the first 45 minutes after the discovery. By Thursday, that figure reached the millions. Wiz Research explained that proving the flaws were exploitable required a complex chain of steps near the limit of human capability. The firm said AI models substantially reduced that barrier, turning a longstanding flaw into a viable exploit.
The incident follows the Hugging Face hack, where autonomous agents cheated on evaluations and attempted to cover it up. This week, AI technology is credited with helping prevent a wider global cybersecurity crisis.
Source: NPR
