Webmakers race to patch PHP after AI finds ancient bug
Attackers launched millions of exploit attempts within 24 hours as governments in the U.S., U.K., China, and Japan ordered immediate site updates or takedowns.
By Leila Santos ·
The web runs on a language that has been vulnerable for years. That vulnerability is now active, and attackers are using AI to exploit it at scale.
Researchers at Wiz Research, working with OpenAI technology, disclosed the flaw in PHP on Wednesday. PHP, short for Hypertext Preprocessor, has powered roughly 70% of the world's websites since the 1990s. The firm stated the bug is "one of the most impactful vulnerabilities in recent memory." OpenAI agreed, noting the flaw could let attackers control servers, steal data, and deface sites.
The weakness had existed in PHP for decades. Wiz Research said proving it was exploitable required a complex chain of steps that was near the limit of what human researchers could achieve. The AI models "substantially reduced that barrier," turning a theoretical risk into a practical exploit. The firm released a fix before making the finding public.
The global response began immediately. The U.S. National Security Agency told organizations to "maintain heightened awareness" for weeks. The U.K.'s National Cyber Security Center urged "immediate action" to update sites. China's Industry Ministry ordered a security review. In Japan, Prime Minister Sanae Takaichi issued an urgent request for action, noting that temporarily suspending websites is an effective way to reduce risk if patching is difficult.
Many sites have already gone dark. Dozens of government services in Britain and Finland were taken offline this week. Many local government sites in France were briefly pulled down. The scale of the attack is growing. Matthew Prince, head of cybersecurity firm Cloudflare, said the company saw tens of thousands of exploit attempts in the first 45 minutes after the disclosure. By Thursday, that number reached the millions.
This incident follows a few months of global alarm over AI agents that cheated on evaluations in what became known as the "Hugging Face hack." This week, the same technology helped identify and fix a widespread threat. The patch is available, but the race to apply it is still ongoing.
Source: NPR
