AI-Assisted Discovery of Severe PHP Flaws Prompts Global Patch Push
Wiz Research, using OpenAI technology, found severe PHP vulnerabilities affecting many websites; governments urged patching as exploitation attempts reached millions.
The story in focus
Wiz Research, using OpenAI technology, announced severe PHP vulnerabilities affecting roughly 70% of websites. Patches are available, and governments from the U.K. to Japan urged organizations to update. Cloudflare reported millions of exploitation attempts, and some government services were taken offline.
- Wiz Research announced on Wednesday it discovered severe flaws in PHP, a language underpinning about 70% of websites.
- OpenAI called the bug one of the most impactful vulnerabilities in recent memory.
- The U.S. NSA warned PHP users to maintain heightened awareness; the U.K. NCSC urged immediate action to patch.
- Dozens of British and Finnish government services were taken offline; many French local government sites were briefly down.
- Cloudflare saw tens of thousands of exploitation attempts in the first 45 minutes, now in the millions.
What was found and who is affected
Cybersecurity firm Wiz Research, using OpenAI technology, announced on Wednesday it had discovered severe vulnerabilities in PHP, the programming language it describes as the backbone of the web. The firm said PHP helps run some 70% of the world's websites and has underpinned much of the internet since the 1990s.
Wiz warned that exploitation could let attackers take control of affected servers, steal sensitive data and deface sites. It said the flaws had been present for decades, but demonstrating exploitability required an exceptionally complex chain of steps.
Patches and official responses
Wiz said it worked on a solution before public disclosure and that a fix is now available. The U.S. National Security Agency warned organizations using PHP to maintain heightened awareness over the coming weeks. The U.K.'s National Cyber Security Center called for immediate action to update websites to the latest patched version.
China's Industry Ministry urged entities to review security gaps. Japan's Prime Minister Sanae Takaichi issued an urgent request for action, saying that if applying the patch promptly is difficult, temporarily suspending websites can effectively reduce risk.
Disruptions and exploitation attempts
Dozens of British and Finnish government services were taken offline this week, and many local government sites in France were briefly taken down. Cloudflare head Matthew Prince said his organization saw tens of thousands of attempts to exploit the flaw in the first 45 minutes of its discovery, now in the millions.
OpenAI called the bug one of the most impactful vulnerabilities in recent memory.
What should organizations running PHP do now?
Wiz says a fix is available. The U.K. cyber agency urged immediate updates to the latest patched version, and Japan's prime minister said temporarily suspending sites can reduce risk if patching is difficult.
Sources & further reading
Help keep the record accurate. Send a correction.
