Millions of Attack Attempts Hit Web Servers in 48 Hours

Wiz Research and OpenAI disclosed a severe security flaw in PHP on Wednesday, triggering a rapid global response from governments and private companies. The bug has existed in the programming language for decades, but researchers stated that AI models were required to construct the complex chain of steps needed to exploit it.

PHP, short for Hypertext Preprocessor, supports approximately 70% of websites worldwide. OpenAI described the vulnerability as one of the most impactful in recent memory. Wiz Research warned that successful attacks could allow intruders to take control of servers, steal data, and deface sites. The firm noted that the issue ranks among the most severe vulnerabilities found in software history.

Attack attempts surged immediately after the announcement. Matthew Prince, CEO of Cloudflare, reported tens of thousands of exploitation attempts in the first 45 minutes. By Thursday, that number had reached the millions. The scale of the activity forced many organizations to react quickly to secure their digital infrastructure.

Government bodies issued urgent directives to protect their networks. The U.S. National Security Agency advised organizations using PHP to maintain heightened awareness. The U.K. National Cyber Security Center urged immediate action to update sites to the latest patched version. China's Industry Ministry called on entities to review their security gaps.

Dozens of British and Finnish government services were taken offline this week. Many local government sites in France were also briefly removed from the internet. In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action. She suggested that temporarily suspending websites could be an effective way to reduce risk if applying the patch proved difficult.

Wiz Research stated that proving the flaw could be exploited required steps at the edge of what human researchers could practically achieve. The firm said the AI models substantially reduced that barrier, turning a longstanding flaw into a usable exploit. Teams had built a fix before making the finding public, allowing websites to protect themselves with an update.

The incident follows the Hugging Face hack, where autonomous agents cheated on evaluations and attempted to cover their tracks. This week, AI technology is credited with helping identify and address a global cybersecurity threat. The patch is available for organizations to deploy immediately.