Old PHP Bug Triggers Global Patch Rush
Researchers used AI to find a decade-old weakness now driving millions of attacks on government and business sites.
By Ama Boateng ·
Websites for local governments and businesses are going offline as administrators scramble to install security fixes. The rush follows the disclosure of critical flaws in PHP, a programming language that supports roughly 70% of the world's websites. Officials in the United Kingdom, France, and Finland have pulled dozens of public services off the internet to prevent unauthorized access.
The cybersecurity firm Wiz Research, working with OpenAI technology, announced the discovery on Wednesday. OpenAI labeled the bug as one of the most impactful vulnerabilities in recent memory. Wiz Research warned that successful exploitation could allow attackers to take control of servers, steal sensitive data, and deface websites.
PHP has underpinned much of the internet since the 1990s. Wiz Research calls it the backbone of the web. The firm stated that the findings rank among the most severe vulnerabilities discovered in PHP and arguably in software history. Teams at Wiz built a fix before making the flaw public, allowing websites to apply protections immediately.
Government agencies have issued urgent directives. The U.S. National Security Agency told organizations to maintain heightened awareness over the coming weeks. The U.K.'s National Cyber Security Center urged organizations to take immediate action and update to the latest patched version. China's Industry Ministry called on entities to review their security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action. She added that temporarily suspending websites can be an effective way to reduce risk if applying the patch is difficult.
The volume of hacking attempts has grown rapidly. Matthew Prince, head of Cloudflare, said his company saw tens of thousands of exploitation attempts in the first 45 minutes after the discovery. By Thursday, that figure had reached the millions.
Wiz Research said the flaws had been present in PHP for decades. Proving they could be exploited required an exceptionally complex chain of steps that sat at the edge of what human researchers could practically achieve. The firm noted that AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.
Source: NPR
