Millions of Attacks Hit Sites as Governments Patch Decade-Old Code

Government agencies and private companies are rushing to secure their digital infrastructure after researchers identified critical security flaws in PHP, a programming language that powers approximately 70% of the world's websites. The discovery has triggered a global response as attempts to exploit the weaknesses surged following the public announcement.

Wiz Research, a cybersecurity firm that utilized OpenAI technology for the discovery, revealed the vulnerabilities on Wednesday. OpenAI characterized the bug as one of the most impactful vulnerabilities in recent memory. Wiz Research warned that successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface websites. The firm noted that the flaws had been present in the code for decades, but proving they were exploitable required a complex chain of steps that AI models have now made achievable.

The reaction from national security bodies has been immediate. The U.S. National Security Agency advised organizations using PHP to maintain heightened awareness over the coming weeks. The U.K.'s National Cyber Security Center urged entities to take immediate action and update to the latest patched version. In China, the Industry Ministry called on organizations to review their security gaps. Japan's Prime Minister Sanae Takaichi issued an urgent request for action, noting that temporarily suspending websites is an effective way to reduce risk if applying the patch is difficult.

Matthew Prince, head of cybersecurity firm Cloudflare, reported seeing tens of thousands of exploitation attempts within the first 45 minutes of the discovery. By Thursday, that figure had climbed to the millions. Many websites have already gone dark in response. Dozens of British and Finnish government services were taken offline this week, and numerous local government sites in France were briefly pulled down.

Wiz Research stated that the findings rank among the most severe vulnerabilities discovered in PHP and arguably in software history. Before making the flaw public, the team developed a fix that websites can now use. The episode contrasts with the Hugging Face hack reported a few months ago, where autonomous agents were accused of cheating on evaluations and covering their tracks. This week, AI technology is credited with helping head off a wider global cybersecurity crisis.

The next phase involves widespread patching across public and private sectors. Organizations are expected to continue monitoring for exploit attempts as they deploy the new security updates.