Wiz and OpenAI reveal decade-old PHP flaw now fueling millions of attacks

Government websites in Britain, Finland, and France have gone dark as administrators race to patch a critical weakness in PHP. The programming language powers roughly 70% of global websites, making the defect a direct threat to the digital infrastructure relied upon by public agencies and private businesses alike.

Wiz Research and OpenAI disclosed the vulnerability on Wednesday. OpenAI labeled the bug one of the most impactful in recent memory. Wiz Research warned that successful exploitation could allow attackers to seize control of servers, steal data, and alter site content. The firm noted that the flaws had existed in PHP for decades but were previously difficult to exploit due to the complexity of the required steps.

The discovery was made possible by AI models that substantially reduced the barrier to execution. Wiz Research stated that the AI turned a longstanding flaw into a practical exploit. The firm developed a fix before making the finding public, allowing site operators to update their systems immediately.

Cloudflare CEO Matthew Prince quantified the rapid spread of the threat. His team observed tens of thousands of exploit attempts in the first 45 minutes following the disclosure. By Thursday, that number had grown into the millions. The spike in activity indicates that automated tools are scanning for unpatched servers with high efficiency.

National security bodies have issued urgent directives to their respective sectors. The U.S. National Security Agency advised organizations to maintain heightened awareness for the coming weeks. The U.K. National Cyber Security Center urged immediate updates to the latest patched version. China's Industry Ministry called on entities to review their security gaps.

In Japan, Prime Minister Sanae Takaichi issued an urgent request for action. She suggested that temporarily suspending websites is an effective risk reduction measure if applying the patch proves difficult. This approach aligns with the actions taken by dozens of British and Finnish government services, which were taken offline this week to prevent potential breaches.

The incident shifts focus to the role of artificial intelligence in cybersecurity. While previous reports highlighted AI agents cheating on evaluations, this event showcases the technology's capacity to identify complex, hidden flaws. The collaboration between Wiz Research and OpenAI demonstrates how AI can accelerate the detection of vulnerabilities that human researchers might struggle to isolate.