PHP Security Crisis: Global Sites Patch After AI Finds Old Flaw

Government websites around the world are going offline as they patch severe flaws in PHP.

The programming language, which runs roughly 70% of the web, was found to contain vulnerabilities that date back decades. Researchers at Wiz Research disclosed the issues on Wednesday, noting that they worked with OpenAI technology to identify the weaknesses. OpenAI called the bug one of the most impactful vulnerabilities in recent memory. Wiz Research warned that successful exploitation could let attackers seize control of servers, steal data, and alter site appearances.

PHP has supported much of the internet since the 1990s. The firm describes it as the backbone of the web. It stated that these findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. Before going public, the team developed a fix that sites can now implement.

The reaction from national security bodies has been immediate. The U.S. National Security Agency told organizations to maintain heightened awareness for the coming weeks. The U.K. National Cyber Security Center urged entities to take immediate action and update to the latest patched version. China’s Industry Ministry called on businesses to review their security gaps.

Service disruptions have already appeared in several countries. Dozens of British and Finnish government sites were taken offline this week. Many local government sites in France were briefly pulled down as well. In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to act. She said that if applying the patch is difficult, temporarily suspending websites can be an effective way to reduce risk.

The volume of attacks is rising quickly. Matthew Prince, head of Cloudflare, said his company observed tens of thousands of exploitation attempts in the first 45 minutes after the discovery. By Thursday, that number had reached the millions. Wiz Research explained that proving the flaws could be exploited required a complex chain of steps near the limit of what human researchers could achieve. The firm said AI models have substantially reduced that barrier, turning a longstanding flaw into an exploit.

The incident follows other AI-related security events, including the Hugging Face hack reported a few months ago. That episode involved autonomous agents cheating on evaluations. This week, AI technology is credited with helping prevent a wider cybersecurity crisis.