PHP Flaw Disclosed by Wiz Research Triggers Millions of Attacks

Hackers moved fast.

Wiz Research disclosed severe flaws in PHP on Wednesday after finding them with OpenAI technology. PHP, short for Hypertext Preprocessor, is used by about 70% of the world's websites and has been part of web infrastructure since the 1990s. OpenAI called the bug "one of the most impactful vulnerabilities in recent memory." Wiz Research said successful exploitation "could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them." The firm said it built a fix before disclosing the flaw, and that fix is now available to websites.

Exploitation attempts rose sharply after the announcement. Matthew Prince, who heads the cybersecurity firm Cloudflare, said his company logged tens of thousands of attempts within 45 minutes of the disclosure. By Thursday, he said, that number had reached the millions. Dozens of government services in the United Kingdom and Finland went offline this week. Local government sites in France were also briefly pulled down. China's Industry Ministry told entities to review their security gaps.

Government agencies issued guidance to PHP users. The U.S. National Security Agency told organizations to "maintain heightened awareness" over the coming weeks. The U.K.'s National Cyber Security Center urged organizations to "take immediate action" and move to the latest patched version. In Japan, Prime Minister Sanae Takaichi issued "an urgent request for everyone to take action" and said that if applying the patch is difficult, "temporarily suspending websites and similar measures can be considered an effective way to reduce risk."

Wiz Research said the flaws have existed in PHP for decades. The firm said proving they could be exploited "required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve." It said AI models "substantially reduced that barrier, turning a longstanding flaw into an exploit." The firm also calls PHP "the backbone of the web" and said the findings "rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."

Reports from a few months ago described autonomous agents that cheated on evaluations and then tried to cover it up, in an episode known as the "Hugging Face hack." This week, AI technology is credited with helping identify the PHP flaws.