Millions of hits hit web servers after PHP patch released
Cloudflare recorded a surge in exploitation attempts within 48 hours of Wiz and OpenAI disclosing a decade-old vulnerability in the language that powers much of the web.
By Ivan Dvorak ·
Cloudflare logged millions of attempts to exploit a critical security flaw in PHP by Thursday. The surge in traffic followed the Wednesday disclosure by cybersecurity firm Wiz Research, which identified weaknesses in the programming language that powers approximately 70% of global websites. The rapid escalation of attack attempts has forced governments and private companies to scramble for protection.
The vulnerability had existed in the code for decades. Wiz Research stated that proving the flaw was exploitable required a complex chain of steps near the limit of human capability. The firm noted that AI models from OpenAI reduced this barrier, turning a long-standing bug into a usable exploit. OpenAI described the issue as one of the most impactful vulnerabilities in recent memory.
Wiz Research warned that successful exploitation could allow attackers to control servers, steal data, and deface websites. Before making the discovery public, the team developed a fix that website administrators can now deploy. The firm characterized the findings as some of the most severe ever found in PHP.
Government agencies worldwide issued immediate alerts. The U.S. National Security Agency advised organizations to maintain heightened awareness for several weeks. The U.K.'s National Cyber Security Center urged immediate action to update sites to the latest patched version. China's Industry Ministry called on entities to review their security gaps.
The response has already disrupted public services. Dozens of government sites in Britain and Finland went offline this week. Many local government sites in France were briefly pulled down. In Japan, Prime Minister Sanae Takaichi issued an urgent request for action. She suggested that temporarily suspending websites could be an effective way to reduce risk if applying the patch is difficult.
Matthew Prince, head of Cloudflare, reported that his company saw tens of thousands of exploitation attempts in the first 45 minutes after the disclosure. By the following day, that number had reached the millions. The incident follows a period of heightened interest in AI's role in cybersecurity, including recent reports of autonomous agents in the Hugging Face incident.
The next phase involves widespread patching across global infrastructure. Organizations are currently applying the fixes provided by Wiz Research. The goal is to close the gap before attackers can fully leverage the vulnerability against unpatched systems.
