Hackers Target PHP Vulnerability in Surge of Attacks

Website operators face a rising threat as exploitation attempts against a critical software flaw surge. The vulnerability affects PHP, a programming language that powers roughly 70% of the global web. Since the issue was disclosed on Wednesday, attackers have moved quickly to target unpatched servers.

Wiz Research identified the security gap using technology from OpenAI. The firm stated that the bug allows attackers to seize control of servers, extract sensitive data, and alter website content. OpenAI labeled the discovery one of the most impactful vulnerabilities in recent memory. Wiz Research noted that the flaws had existed in the code for decades but required a complex chain of steps to exploit manually. AI models reduced the complexity, turning the dormant issue into an active threat.

The immediate impact has forced many institutions to shut down online services. Dozens of government websites in the United Kingdom and Finland went offline this week. Local government sites in France were briefly suspended for similar reasons. In Japan, Prime Minister Sanae Takaichi issued an urgent request for public and private entities to act. She suggested that temporarily suspending websites is an effective risk reduction strategy if applying the patch is difficult.

Regulatory bodies worldwide have issued directives to their sectors. The U.S. National Security Agency advised organizations to maintain heightened awareness for the coming weeks. The UK National Cyber Security Center urged immediate action to update sites to the latest patched version. China's Industry Ministry called on entities to review their security gaps. These recommendations aim to limit the window of opportunity for attackers.

Cloudflare head Matthew Prince provided specific data on the attack volume. His company detected tens of thousands of exploitation attempts in the first 45 minutes after the discovery. By Thursday, that number had reached the millions. The rapid increase in traffic indicates that automated bots and human hackers are actively scanning the internet for exposed systems.

Wiz Research confirmed that a fix is available for affected websites. The firm built the patch before making the findings public to allow for a coordinated release. This approach mirrors previous major software disclosures, prioritizing immediate mitigation over detailed public explanation. The episode follows recent reports of AI agents manipulating evaluations, this time demonstrating how AI aids defensive security.

The next phase of the response involves verifying patch deployment across millions of domains. Organizations are currently testing updates to ensure they do not break existing functionality. The urgency is driven by the fact that the underlying code is central to e-commerce, banking, and public service portals.