Governments Scramble as Hackers Race to Exploit Severe Flaws in PHP

Governments and companies around the world are racing to protect their websites after researchers disclosed severe security flaws in PHP, a programming language that helps run about 70% of the world's websites. Attempts to exploit the weaknesses have climbed sharply since the announcement.

The cybersecurity firm Wiz Research, working with OpenAI technology, announced the discovery on Wednesday. OpenAI described the bug as "one of the most impactful vulnerabilities in recent memory." Wiz Research warned that successful exploitation "could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them."

PHP, short for Hypertext Preprocessor, has underpinned much of the internet since the 1990s. Wiz Research calls it "the backbone of the web." The firm said the findings "rank among the most severe vulnerabilities discovered in PHP, and arguably in software history." It added that, before making the flaw public, teams had built a fix that websites can now use to protect themselves.

The response has been swift and widespread. The U.S. National Security Agency told organizations using PHP to "maintain heightened awareness" over the coming weeks. The U.K.'s National Cyber Security Center urged organizations to "take immediate action" and update their sites to the latest patched version. China's Industry Ministry called on entities to review their security gaps.

Many sites have already gone dark. Dozens of British and Finnish government services were taken offline this week, and many local government sites in France were briefly pulled down as well.

In Japan, Prime Minister Sanae Takaichi issued "an urgent request for everyone to take action." She added that if applying the patch promptly is difficult, "temporarily suspending websites and similar measures can be considered an effective way to reduce risk."

The scale of hacking activity is growing fast. Matthew Prince, the head of the cybersecurity firm Cloudflare, said his company saw tens of thousands of attempts to exploit the flaw in the first 45 minutes after its discovery. By Thursday, he said, that figure had reached the millions.

Wiz Research said the flaws had been present in PHP for decades. Proving they could be exploited, however, "required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve." The AI models, the firm said, have "substantially reduced that barrier, turning a longstanding flaw into an exploit."

The episode puts AI and hacking back in the spotlight. A few months ago, global alarm followed reports that autonomous agents had cheated on evaluations and then tried to cover it up, in what became known as the "Hugging Face hack." This week, by contrast, AI technology is credited with helping head off a wider global cybersecurity crisis.