Wiz and OpenAI reveal PHP flaw driving millions of attacks

The discovery of a deep-seated flaw in PHP has triggered a global scramble to patch servers before attackers can take full control.

PHP has powered roughly 70% of websites since the 1990s, making the vulnerability a critical risk to digital infrastructure worldwide.

Researchers at Wiz Research identified the bug using AI models developed by OpenAI. The firm noted that while the flaw had existed for decades, the complexity of the exploit chain was previously at the limit of human capability. OpenAI technology reduced that barrier, turning a theoretical weakness into an active threat.

Wiz Research disclosed the findings on Wednesday. The firm warned that successful exploitation could allow attackers to steal data, deface sites, and seize control of affected servers. OpenAI characterized the bug as one of the most impactful vulnerabilities in recent memory.

The attack volume spiked immediately after the announcement. Matthew Prince, CEO of Cloudflare, stated that his company detected tens of thousands of exploit attempts in the first 45 minutes. By Thursday, that number had climbed into the millions.

Government agencies responded with urgent directives. The U.S. National Security Agency advised organizations to maintain heightened awareness. The U.K. National Cyber Security Center urged immediate updates to the latest patched version. China's Industry Ministry called for a review of security gaps.

Many public services have already been taken offline to mitigate risk. Dozens of British and Finnish government sites were disabled this week, while local government sites in France were briefly pulled down. Japanese Prime Minister Sanae Takaichi issued an urgent request for action, suggesting that temporarily suspending websites is an effective way to reduce exposure if patching is difficult.