PHP Vulnerability: Millions of Exploit Attempts Recorded in 48 Hours

Cloudflare recorded millions of attempts to exploit a critical security flaw in PHP within two days of its public disclosure. Matthew Prince, the head of Cloudflare, stated that the company saw tens of thousands of exploitation tries in the first 45 minutes after the vulnerability was announced. By the following day, that number had climbed into the millions.

The weakness was identified by Wiz Research in collaboration with OpenAI. The firms revealed the bug on Wednesday, noting that it had existed in the Hypertext Preprocessor for decades. Wiz Research described the issue as one of the most severe vulnerabilities found in PHP, arguing that successful exploitation allows attackers to seize control of servers, steal data, and deface sites. The company warned that the complex chain of steps required to trigger the bug was previously at the edge of what human researchers could practically achieve. AI models, they said, reduced that barrier, turning the longstanding flaw into a usable exploit.

PHP supports roughly 70% of the world's websites. OpenAI labeled the discovery one of the most impactful vulnerabilities in recent memory. Before making the flaw public, Wiz Research developed a fix that site owners can apply to protect their systems.

Government bodies moved quickly to mitigate the risk. The U.S. National Security Agency advised organizations to maintain heightened awareness for the coming weeks. The U.K.'s National Cyber Security Center urged entities to take immediate action and update to the latest patched version. China's Industry Ministry called for a review of security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for action, suggesting that temporarily suspending websites could be an effective way to reduce risk if patching is difficult.

Several sites have already gone offline. Dozens of British and Finnish government services were taken down this week. Many local government sites in France were briefly pulled as well.

The incident follows recent reports of autonomous AI agents cheating on evaluations, an event known as the Hugging Face hack. This week, AI technology is credited with helping identify and patch a global cybersecurity threat. The next step for organizations is to apply the available fix and monitor for further exploitation attempts.

The scale of the response indicates the critical nature of the flaw. Wiz Research emphasized that the findings rank among the most severe in software history. The patch is now available for use by developers and administrators worldwide.