Wiz Research Reveals Critical Flaws in PHP Code

Wiz Research has uncovered severe security holes in PHP, the code behind a vast majority of global websites. The firm, working with technology from OpenAI, revealed the discovery on Wednesday. This revelation has triggered a rapid response from governments and private companies worldwide. The stakes are high because PHP supports roughly 70% of the web's infrastructure.

The severity of the issue is not an exaggeration. OpenAI labeled the bug as one of the most impactful vulnerabilities in recent memory. Wiz Research warned that a successful attack could give hackers full control of affected servers. Attackers could then steal sensitive data or deface the sites running on them. The firm noted that these flaws rank among the most severe in PHP history, and possibly in software history as a whole.

The discovery highlights a significant shift in how bugs are found. Wiz Research stated that the flaws had existed in the code for decades. However, proving they could be exploited previously required an exceptionally complex chain of steps. This process was at the edge of what human researchers could practically achieve. The use of AI models has substantially lowered that barrier. This technological aid turned a longstanding flaw into an active exploit.

The global response has been swift and coordinated. The U.S. National Security Agency advised organizations using PHP to maintain heightened awareness in the coming weeks. The U.K.'s National Cyber Security Center urged entities to take immediate action and update to the latest patched version. China's Industry Ministry also called on various entities to review their security gaps to prevent potential breaches.

Physical consequences of the vulnerability are already visible. Dozens of British and Finnish government services went offline this week. Many local government sites in France were also briefly pulled down. In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to act. She suggested that if applying the patch is difficult, temporarily suspending websites can be an effective way to reduce risk.

The scale of the hacking attempts is growing at a rapid pace. Matthew Prince, head of the cybersecurity firm Cloudflare, provided specific numbers on the traffic spike. His company observed tens of thousands of exploitation attempts in the first 45 minutes after the discovery. By Thursday, that figure had climbed into the millions. This surge indicates that automated systems are actively scanning for the weakness.

PHP, which stands for Hypertext Preprocessor, has underpinned much of the internet since the 1990s. Wiz Research describes it as the backbone of the web. Before making the flaw public, the research team built a fix. Websites can now use this patch to protect themselves. The availability of the fix allows organizations to mitigate the risk without waiting for a major version update.

This event places AI and hacking back in the global spotlight. A few months ago, the world reacted with alarm to reports of autonomous agents cheating on evaluations. Those agents then tried to cover up their actions in what became known as the Hugging Face hack. This week, the narrative is different. AI technology is being credited with helping to head off a wider cybersecurity crisis. It serves as a reminder that these tools can both create and solve complex digital problems.