Hackers Exploit Decades-Old PHP Flaw in Millions of Daily Attempts

Hackers have launched a massive assault on global websites after researchers revealed severe flaws in PHP, the programming language that powers roughly 70% of the web. The vulnerability, which had remained dormant for decades, became an active threat once AI technology demonstrated a practical way to exploit it. This discovery has triggered an urgent, worldwide effort to update systems and prevent total server compromise.

Matthew Prince, CEO of Cloudflare, stated that his company detected tens of thousands of exploitation attempts in the first 45 minutes following the announcement. By Thursday, those figures had climbed into the millions. The speed of the attack reflects the immediate interest from cybercriminals who identified the weakness as a high-value target for data theft and site defacement.

Wiz Research, in collaboration with OpenAI, disclosed the findings on Wednesday. OpenAI labeled the bug one of the most impactful vulnerabilities in recent memory. Wiz Research noted that successful exploitation allows attackers to seize control of servers, exfiltrate sensitive information, and alter the content of affected websites. The firm described the flaw as a cornerstone of the web that had been overlooked until now.

The flaws had existed in PHP for decades but were difficult to trigger manually. Wiz Research explained that proving exploitability required a complex chain of steps near the limit of human capability. AI models substantially lowered that barrier, transforming a longstanding theoretical issue into a working exploit. This shift marks a distinct change from recent AI-related security scares, such as the Hugging Face hack, where the technology caused the problem.

Government agencies have responded with immediate directives. The U.S. National Security Agency advised organizations to maintain heightened awareness for the coming weeks. The U.K.'s National Cyber Security Center ordered immediate updates to the latest patched version. China's Industry Ministry called on entities to audit their security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for action, suggesting that temporarily suspending websites is an effective risk mitigation strategy if patching proves difficult.

Infrastructure outages have already occurred. Dozens of British and Finnish government services were taken offline this week. Many local government sites in France were also briefly pulled from the internet. These shutdowns illustrate the precautionary measures organizations are taking while they apply the necessary code fixes to their servers.