Government leaders urge PHP sites to patch now

Global websites are falling offline as hackers rush to exploit a critical weakness in PHP.

Wiz Research announced the discovery on Wednesday, working alongside OpenAI technology. The firm stated that the flaw allows attackers to take control of affected servers, steal sensitive data, and deface websites. OpenAI described the bug as one of the most impactful vulnerabilities in recent memory. PHP, which has powered much of the internet since the 1990s, supports approximately 70% of the world's websites.

The vulnerability had existed for decades, but Wiz Research noted that proving it could be exploited required an exceptionally complex chain of steps. The firm said AI models substantially reduced that barrier, turning a longstanding flaw into an active exploit. Before making the issue public, the team built a fix that websites can now apply.

Government agencies reacted quickly to the threat. The U.S. National Security Agency told organizations using PHP to maintain heightened awareness for the coming weeks. The U.K.'s National Cyber Security Center urged organizations to take immediate action and update their sites. China's Industry Ministry called on entities to review their security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action. She suggested that temporarily suspending websites can be an effective way to reduce risk if applying the patch is difficult.

Many government services have already gone dark. Dozens of British and Finnish government sites were taken offline this week. Many local government sites in France were also briefly pulled down.

Cloudflare head Matthew Prince reported a surge in hacking activity. His company saw tens of thousands of exploit attempts in the first 45 minutes after the discovery. By Thursday, that figure had reached the millions.

This incident follows recent reports of AI agents cheating on evaluations and covering it up, known as the Hugging Face hack. This week, however, AI technology helped identify a bug that threatened global web infrastructure.