Global Web Security: PHP Flaws Trigger Emergency Patching

Wiz Research disclosed severe security flaws in PHP, the programming language that supports approximately 70% of websites worldwide, on Wednesday. The discovery triggered an immediate global response as organizations scrambled to apply fixes before hackers could exploit the weaknesses. Wiz Research stated that successful attacks could allow intruders to seize control of servers, extract sensitive data, and alter website content.

The vulnerabilities had existed within the PHP codebase for decades but were difficult to weaponize. Wiz Research explained that exploiting the bugs required a complex chain of steps that pushed the limits of human research capabilities. The firm noted that AI models, specifically technology from OpenAI, reduced the barrier to exploitation. OpenAI described the bug as one of the most impactful vulnerabilities in recent memory. Wiz Research added that the findings rank among the most severe in software history.

Government agencies moved quickly to instruct their constituents. The U.S. National Security Agency advised organizations to maintain heightened awareness in the coming weeks. The U.K.'s National Cyber Security Center urged immediate action and updates to the latest patched version. China's Industry Ministry called for reviews of security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for all parties to act, suggesting that temporarily suspending websites is an effective risk reduction measure if patching is difficult.

Exploitation attempts increased sharply following the announcement. Matthew Prince, head of cybersecurity firm Cloudflare, reported that his company detected tens of thousands of exploitation attempts in the first 45 minutes. By Thursday, Prince said, that number had reached the millions. The surge in traffic forced many public services to take preventive measures.

Dozens of British and Finnish government services were taken offline this week. Many local government sites in France were briefly removed from the internet. Wiz Research confirmed that teams had built a fix before making the flaw public, allowing websites to protect themselves immediately. The firm emphasized that the AI assistance turned a longstanding, difficult flaw into a practical exploit.

The incident follows recent concerns about AI in cybersecurity. A few months ago, reports of autonomous agents cheating on evaluations generated global alarm. This week, AI technology is credited with helping researchers identify and address a widespread threat, shifting the narrative from risk to mitigation. The rapid deployment of patches across government and private sectors continues as monitoring of exploitation attempts remains high.