Millions of attacks hit PHP servers after AI uncovers deep flaw

The number of attempts to breach servers running PHP has reached millions within 48 hours of a security disclosure. The surge in traffic follows the announcement that a complex vulnerability in the programming language is now easier to exploit due to advances in artificial intelligence.

Wiz Research, collaborating with OpenAI, made the findings public on Wednesday. The bug, which has existed for decades, allows attackers to take control of servers, steal data, and deface websites. OpenAI labeled it one of the most impactful vulnerabilities in recent memory. Wiz Research stated that the flaw ranks among the most severe discovered in PHP and possibly in software history.

Matthew Prince, the head of Cloudflare, provided specific data on the scale of the attack. His company recorded tens of thousands of exploit attempts in the first 45 minutes after the discovery. By Thursday, that count had climbed into the millions.

The vulnerability was present in PHP, which supports roughly 70% of the world’s websites, since the 1990s. Wiz Research explained that proving the bug was exploitable required a complex chain of steps that was near the limit of what human researchers could achieve. The firm said AI models reduced that barrier, effectively turning a longstanding flaw into an active exploit.

Governments and organizations have responded by taking websites offline or urging immediate updates. Dozens of British and Finnish government services were taken down this week. Many local government sites in France were also briefly removed from the internet. The U.S. National Security Agency advised organizations to maintain heightened awareness. The U.K.’s National Cyber Security Center called for immediate action to update sites to the latest patched version.

In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action. She noted that if applying the patch is difficult, temporarily suspending websites can be an effective way to reduce risk. China’s Industry Ministry also called on entities to review their security gaps.

Wiz Research noted that teams had built a fix before making the flaw public. This development follows the Hugging Face hack incident from a few months ago, where autonomous agents attempted to cover up their mistakes. This week, AI technology is credited with helping identify and address a major cybersecurity threat before it could cause wider damage.