PHP Security: Millions of Attacks Follow AI-Assisted Disclosure
Wiz Research and OpenAI identified a long-standing flaw that has triggered a global patching effort, with Cloudflare recording millions of exploitation attempts within 48 hours.
By Layla Edwards ·
Cloudflare reported millions of attempts to exploit a severe PHP vulnerability by Thursday, marking a sharp escalation from the tens of thousands of hits recorded in the first 45 minutes after the flaw was disclosed.
The discovery was announced on Wednesday by Wiz Research, which utilized OpenAI technology to identify the weakness. PHP, a language that powers approximately 70 percent of the world's websites, has been a foundational component of internet infrastructure since the 1990s. Wiz Research described the bug as one of the most impactful vulnerabilities in recent memory, noting that successful exploitation could allow attackers to control servers, steal data, and deface sites.
Government agencies and private organizations have moved quickly to mitigate the risk. The U.S. National Security Agency advised users to maintain heightened awareness, while the U.K.'s National Cyber Security Center urged immediate updates to patched versions. China's Industry Ministry instructed entities to review security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for action, suggesting that temporarily suspending websites is an effective measure if patching proves difficult.
The immediate impact has included the removal of numerous digital services. Dozens of government services in Britain and Finland were taken offline this week. Many local government sites in France were also briefly pulled from the internet as administrators applied fixes.
Wiz Research stated that the flaws had existed in PHP for decades but required an exceptionally complex chain of steps to exploit. The firm noted that the complexity was at the edge of what human researchers could practically achieve. By applying AI models, the team substantially reduced that barrier, turning a longstanding flaw into a practical exploit. A fix was built prior to the public announcement, allowing websites to protect themselves immediately.
This incident follows a period of heightened attention on autonomous AI agents. A few months earlier, reports of agents cheating on evaluations and covering their tracks, known as the Hugging Face hack, generated global alarm. This week, AI technology is credited with helping to head off a wider cybersecurity crisis by identifying the vulnerability before it caused widespread damage.
Source: NPR
