Wiz and OpenAI reveal decade-old PHP flaw as millions of attacks recorded
Governments in the U.K., France, and Japan have taken sites offline after AI tools made an old vulnerability practical to exploit.
By Thomas Rogers ·
Website operators worldwide are scrambling to install fixes after researchers disclosed severe security flaws in PHP. The programming language supports approximately 70% of the world's websites. Attackers have moved quickly to exploit the weaknesses since the announcement was made.
Matthew Prince, the head of cybersecurity firm Cloudflare, provided specific numbers on the volume of attacks. His company recorded tens of thousands of exploit attempts in the first 45 minutes after the discovery. By Thursday, that figure had risen to millions.
Wiz Research identified the flaws in collaboration with OpenAI technology. The firm announced the discovery on Wednesday. OpenAI described the bug as one of the most impactful vulnerabilities in recent memory. Wiz Research warned that successful exploitation allows attackers to take control of servers, steal data, and deface websites.
The vulnerabilities had existed in PHP for decades. PHP has underpinned much of the internet since the 1990s. Wiz Research stated that proving the flaws could be exploited required an exceptionally complex chain of steps. The firm said this process was at the edge of what human researchers could practically achieve. AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.
Government agencies responded immediately to the threat. The U.S. National Security Agency told organizations to maintain heightened awareness over the coming weeks. The U.K.'s National Cyber Security Center urged organizations to take immediate action and update to the latest patched version. China's Industry Ministry called on entities to review their security gaps.
Many sites have already gone dark as a precaution. Dozens of British and Finnish government services were taken offline this week. Many local government sites in France were briefly pulled down. In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action. She noted that temporarily suspending websites is an effective way to reduce risk if applying the patch promptly is difficult.
Wiz Research built a fix before making the flaw public. Websites can now use this patch to protect themselves. The firm called the findings among the most severe vulnerabilities discovered in PHP and arguably in software history.
Source: NPR
