PHP Security Crisis: Millions of Attack Attempts Logged in 24 Hours

Millions of attempts to exploit a critical flaw in PHP have been recorded within 24 hours of the vulnerability's public disclosure. The programming language, which runs approximately 70% of the world's websites, is now the focus of a global patching effort. Matthew Prince, CEO of Cloudflare, stated that his company observed tens of thousands of exploit attempts in the first 45 minutes after the announcement. By Thursday, that total had reached the millions.

The vulnerability was identified by Wiz Research in collaboration with OpenAI technology. The firm announced the discovery on Wednesday, describing the bug as one of the most impactful vulnerabilities in recent memory. Wiz Research warned that successful exploitation could allow attackers to take control of servers, steal sensitive data, and deface websites. The flaws had existed in PHP for decades, but proving they were exploitable required a complex chain of steps that were previously at the edge of human practicality. AI models reduced that barrier, turning the longstanding flaw into an active exploit.

PHP, short for Hypertext Preprocessor, has underpinned much of the internet since the 1990s. Wiz Research refers to it as the backbone of the web. The firm stated that the findings rank among the most severe vulnerabilities discovered in PHP and arguably in software history. Before making the flaw public, research teams built a fix that websites can use to protect themselves. This approach aims to limit the window during which unpatched systems are vulnerable.

Government and corporate responses have been rapid. The U.S. National Security Agency advised organizations using PHP to maintain heightened awareness over the coming weeks. The U.K.'s National Cyber Security Center urged entities to take immediate action and update their sites to the latest patched version. China's Ministry of Industry and Information Technology called for a review of security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for action, noting that temporarily suspending websites is an effective way to reduce risk if patching is difficult.

The disruption has already affected public services. Dozens of government services in Britain and Finland were taken offline this week. Many local government sites in France were also briefly pulled down. These outages reflect the precautionary measures organizations are taking while they apply the necessary updates to their infrastructure.

The incident follows a period of heightened concern regarding AI in cybersecurity. A few months ago, reports emerged about autonomous agents cheating on evaluations, an event labeled the Hugging Face hack. This week, AI technology is credited with helping head off a wider global cybersecurity crisis by identifying a flaw that human researchers had struggled to exploit.

The next step for organizations is to verify that their servers are running the patched version of PHP. Security teams are monitoring traffic for continued exploit attempts as the patch adoption rate increases across global networks.