Millions of PHP attacks surge

Tens of thousands of intrusion attempts hit PHP servers in the first 45 minutes after a new vulnerability was revealed on Wednesday. By Thursday, that count had swelled to the millions, according to Matthew Prince, the head of Cloudflare. The spike in traffic followed the public disclosure of severe flaws in a programming language that powers roughly 70 percent of websites globally.

Wiz Research, in collaboration with OpenAI, identified the weaknesses. The companies stated that the bug represents one of the most impactful vulnerabilities in recent memory. Wiz Research warned that successful exploitation could allow attackers to seize control of servers, steal sensitive data, and deface the affected websites. The firm described PHP as the backbone of the web, noting that the specific flaws rank among the most severe discovered in the language's history.

The response from government bodies has been immediate and defensive. The U.S. National Security Agency advised organizations using the language to maintain heightened awareness for the coming weeks. In the United Kingdom, the National Cyber Security Center urged entities to take immediate action and update to the latest patched version. China's Industry Ministry similarly called for a review of security gaps. Dozens of government services in Britain and Finland were taken offline this week, while many local government sites in France were briefly suspended.

Prime Minister Sanae Takaichi of Japan issued an urgent request for all parties to take action. She noted that if applying the patch is difficult, temporarily suspending websites can be an effective way to reduce risk. These measures reflect a global rush to secure infrastructure before hackers can fully exploit the identified gaps.

Wiz Research explained that the flaws had existed in PHP for decades. However, proving they could be exploited required an exceptionally complex chain of steps that was at the edge of what human researchers could practically achieve. The company said AI models substantially reduced that barrier, turning a longstanding flaw into a practical exploit. This development contrasts with recent reports of autonomous agents cheating on evaluations, a series of events known as the Hugging Face hack. This week, AI technology helped head off a wider cybersecurity crisis.

Before making the flaw public, the research teams built a fix that websites can now use. The availability of this patch is central to the current global response, as organizations race to close the window of vulnerability. The episode underscores the shifting dynamic in cybersecurity, where artificial intelligence serves as both a tool for discovery and a driver of rapid exploitation.