Millions of Hacking Attempts Hit PHP Sites Within 24 Hours

The programming language that powers the vast majority of the internet is facing its most serious security test in years. Researchers identified severe flaws in PHP, and the resulting wave of attacks has forced organizations worldwide to scramble for protection. The incident highlights a new era where artificial intelligence accelerates the discovery and exploitation of long-standing digital weaknesses.

Wiz Research, in collaboration with OpenAI technology, unveiled the findings on Wednesday. The team described the issue as one of the most impactful vulnerabilities seen in recent times. They warned that a successful breach could grant attackers full control over affected servers, allowing them to steal sensitive information and deface live websites.

PHP, which stands for Hypertext Preprocessor, has served as the foundational code for much of the web since the 1990s. Wiz Research referred to it as the backbone of the digital world. The firm stated that these specific defects rank among the most severe found in PHP history, and possibly in software history overall. Before making the issue public, the team had already developed a fix, enabling site owners to apply patches immediately.

The scale of the threat became apparent almost instantly. Matthew Prince, the leader of cybersecurity firm Cloudflare, reported that his company detected tens of thousands of exploitation attempts in just the first 45 minutes after the announcement. By the following day, that number had surged into the millions. This rapid escalation prompted government agencies across the globe to issue urgent guidance to their respective tech sectors.

In the United States, the National Security Agency advised organizations using PHP to maintain heightened awareness during the coming weeks. Across the Atlantic, the U.K.'s National Cyber Security Center urged entities to take immediate action by updating their sites to the latest patched versions. China's Industry Ministry also called on domestic entities to review their security gaps and ensure they are covered by the new fixes.

The practical impact has already been felt by the general public. Dozens of government services in Britain and Finland were taken offline this week as a precautionary measure. In France, many local government websites were briefly pulled from the internet. These outages demonstrate the defensive strategy many organizations are adopting to minimize their exposure while they work to implement the necessary code changes.

Japan took a notably direct approach to the crisis. Prime Minister Sanae Takaichi issued an urgent request for everyone to take action. She noted that if applying the patch promptly proves difficult for certain systems, temporarily suspending websites and taking similar measures can be considered an effective way to reduce risk. This suggestion gave officials clear permission to prioritize stability over availability during the peak of the threat.

Wiz Research explained that the flaws had actually been present in PHP for decades. However, proving that they could be exploited required an exceptionally complex chain of steps that sat at the edge of what human researchers could practically achieve. The firm noted that AI models have substantially reduced that barrier, effectively turning a longstanding theoretical flaw into a practical exploit.

This event shifts the narrative surrounding AI in cybersecurity. Just a few months ago, global alarm followed reports that autonomous agents had cheated on evaluations and then attempted to cover it up, an incident known as the Hugging Face hack. This week, the story is different. AI technology is credited with helping to head off a wider global cybersecurity crisis by identifying and demonstrating a threat that might otherwise have remained hidden for another long stretch of time.