Wiz and OpenAI reveal PHP bug driving millions of attacks
Government websites across Europe and Asia have gone offline as organizations rush to patch a decades-old flaw.
By Natalia Costa ·
Websites for government services in the United Kingdom, Finland, and France have gone dark this week. The shutdowns are a precautionary measure taken by officials to protect their systems from a newly disclosed security flaw in PHP. The programming language runs an estimated 70% of the web's sites.
Wiz Research and OpenAI announced the discovery on Wednesday. They identified a vulnerability that has existed in the software for decades. OpenAI described the bug as one of the most impactful in recent memory. Wiz Research warned that a successful exploit could allow attackers to control servers, steal data, and alter website content.
The scale of the threat has grown rapidly since the announcement. Matthew Prince, the head of Cloudflare, reported that his company detected tens of thousands of exploit attempts in the first 45 minutes after the discovery. By Thursday, he said the number of attempts had reached the millions.
Government agencies are urging organizations to act quickly. The U.S. National Security Agency told entities using PHP to maintain heightened awareness over the coming weeks. The U.K.'s National Cyber Security Center advised organizations to take immediate action and update their sites to the latest patched version. China's Ministry of Industry and Information Technology called on entities to review their security gaps.
In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action. She noted that temporarily suspending websites can be an effective way to reduce risk if applying the patch is difficult. This advice aligns with the actions already taken by local governments in France, which briefly pulled down many of their sites.
Wiz Research stated that the flaws rank among the most severe discovered in PHP and arguably in software history. The firm explained that proving the bug could be exploited required a complex chain of steps that was at the edge of what human researchers could practically achieve. The AI models used in the discovery substantially reduced that barrier, turning the longstanding flaw into a usable exploit. A fix is now available for website operators to use.
