Attackers Hammer PHP Servers as Governments Pull Sites Offline
Cloudflare logged tens of thousands of exploit attempts in the first 45 minutes after disclosure, reaching millions by Thursday.
By David Almasi ·
Software that runs roughly 70% of the world's websites sits at the center of an active exploitation wave after researchers disclosed flaws in the PHP language, prompting governments to disable public services while patches roll out.
Wiz Research announced the discovery Wednesday using OpenAI technology. OpenAI called the bug "one of the most impactful vulnerabilities in recent memory." Wiz Research said successful exploitation "could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them." The flaws have existed in PHP for decades, but Wiz Research said proving they could be exploited "required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve," and that AI models "substantially reduced that barrier, turning a longstanding flaw into an exploit."
PHP, short for Hypertext Preprocessor, has powered web infrastructure since the 1990s. Wiz Research calls it "the backbone of the web" and said the findings "rank among the most severe vulnerabilities discovered in PHP, and arguably in software history." Before publishing, the firm said, teams had built a patch that sites can apply.
Government agencies responded within the day. The U.S. National Security Agency told organizations using PHP to "maintain heightened awareness" over coming weeks. The U.K.'s National Cyber Security Center urged organizations to "take immediate action" and update to the latest patched version. China's Industry Ministry called on entities to review their security gaps. In Japan, Prime Minister Sanae Takaichi issued "an urgent request for everyone to take action" and said that if applying the patch promptly is difficult, "temporarily suspending websites and similar measures can be considered an effective way to reduce risk."
Sites have already gone dark. Dozens of British and Finnish government services were taken offline this week, and many local government sites in France were briefly pulled down as well.
Cloudflare chief executive Matthew Prince said his company counted tens of thousands of attempts to exploit the flaw in the first 45 minutes after disclosure. By Thursday, that figure had reached the millions, Prince said.
