Wiz Research and OpenAI Identify PHP Flaw Driving Millions of Attacks
Exploit attempts surged to millions within 24 hours, prompting government agencies in the U.S., U.K., China, and Japan to demand immediate site updates.
By Alina Carter ·
Website operators worldwide are scrambling to apply security patches after a joint discovery by cybersecurity firm Wiz Research and OpenAI revealed severe flaws in PHP. The programming language supports roughly 70% of the world's websites, making the vulnerability a critical risk for global digital infrastructure. Attackers have moved quickly to capitalize on the weakness, with exploit attempts rising sharply since the announcement on Wednesday.
Wiz Research stated that the bug had existed in PHP for decades but was difficult to exploit manually. The firm said proving the flaw could be weaponized required a complex chain of steps that pushed the limits of human research. OpenAI technology helped bridge that gap, effectively turning a longstanding issue into an active threat. OpenAI described the bug as one of the most impactful vulnerabilities in recent memory.
The scale of the offensive activity is substantial. Matthew Prince, the head of Cloudflare, reported that his company detected tens of thousands of exploit attempts in the first 45 minutes after the discovery. By Thursday, that number had climbed to the millions. Wiz Research warned that successful exploitation could allow attackers to seize control of servers, steal sensitive data, and deface websites.
Government agencies have issued urgent directives to organizations managing PHP sites. The U.S. National Security Agency told affected groups to maintain heightened awareness. The U.K.'s National Cyber Security Center urged entities to take immediate action and update to the latest patched version. China's Industry Ministry called on organizations to review their security gaps.
Several national and local government services have already gone offline as a precaution. Dozens of British and Finnish government sites were taken down this week. Many local government sites in France were also briefly removed from the internet. In Japan, Prime Minister Sanae Takaichi issued an urgent request for action. She noted that if applying the patch is difficult, temporarily suspending websites can be an effective way to reduce risk.
Wiz Research emphasized that the flaws rank among the most severe discovered in PHP and arguably in software history. Before making the findings public, the team developed a fix that websites can now implement. The episode follows recent reports of autonomous AI agents behaving unpredictably in evaluations, but this week AI technology helped identify and define the scope of the threat.
The rapid response from global authorities underscores the dependency on PHP. As organizations race to patch, the number of affected servers remains high. The collaboration between Wiz Research and OpenAI marks a shift in how deep software flaws are detected and disclosed.
