Wiz Research Reveals Deep PHP Flaws That AI Helped Uncover

The internet’s foundation is currently under stress as a hidden weakness in a core programming tool exposes millions of websites to potential takeover. The urgency has spread globally, with public institutions and private firms racing to patch their systems before malicious actors can capitalize on the gap. This sudden scramble highlights a growing tension: the code that has held the web together for decades may finally be showing its age in a way that is both dangerous and difficult to fix quickly.

The crisis emerged after Wiz Research, a cybersecurity firm, announced the discovery on Wednesday. They collaborated with OpenAI technology to identify the severe flaws in PHP, a language that supports roughly 70 percent of the world's websites. OpenAI characterized the bug as one of the most impactful vulnerabilities in recent memory. Wiz Research warned that if attackers succeed, they could seize control of servers, extract sensitive information, and alter the appearance of the affected sites.

PHP, which stands for Hypertext Preprocessor, has been a staple of web development since the 1990s. Wiz Research describes it as the backbone of the web and says these findings rank among the most severe ever found in the language. The team developed a fix before releasing the news, allowing site owners to update their systems immediately. However, the speed of the response from governments and companies around the world indicates just how serious the threat is perceived to be.

Official reactions have been swift and widespread. The U.S. National Security Agency advised organizations to maintain heightened awareness in the coming weeks. In the U.K., the National Cyber Security Center urged immediate action and updates to the latest patched version. China's Industry Ministry also called on entities to review their security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to act, suggesting that temporarily suspending websites could be an effective way to reduce risk if applying the patch is difficult.

The practical impact is already visible. Dozens of government services in Britain and Finland went offline this week. Many local government sites in France were also briefly taken down as a precautionary measure. These outages serve as a tangible reminder of the stakes, as agencies weigh the inconvenience of downtime against the danger of a potential breach.

The volume of hacking activity has exploded since the announcement. Matthew Prince, head of Cloudflare, reported that his company observed tens of thousands of exploitation attempts in the first 45 minutes after the discovery. By Thursday, that number had climbed into the millions. This rapid escalation underscores the race between defenders who are patching systems and attackers who are testing for weaknesses.

Wiz Research noted that these flaws had existed in PHP for decades. However, proving they could be exploited required an exceptionally complex chain of steps that pushed the limits of what human researchers could practically achieve. The firm stated that AI models substantially reduced that barrier, turning a longstanding flaw into a workable exploit. This development puts AI and hacking back in the spotlight, following recent reports of autonomous agents misbehaving in evaluations. This time, though, AI technology is credited with helping to head off a wider global cybersecurity crisis.