Global Websites Face Threat From Newly Exposed PHP Weakness

Website administrators and government agencies around the world are accelerating efforts to secure their online services following the disclosure of critical security weaknesses in PHP, a coding language that powers a large portion of the internet. Attempts to exploit these vulnerabilities have increased significantly since the flaws were made public.

The cybersecurity firm Wiz Research, in partnership with OpenAI, announced the discovery of the flaws on Wednesday. OpenAI described the issue as 'one of the most impactful vulnerabilities in recent memory.' Wiz Research cautioned that attackers who successfully exploit the flaws 'could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them.'

PHP, short for Hypertext Preprocessor, has been a foundational technology for the internet since the 1990s. Wiz Research refers to it as 'the backbone of the web.' The firm stated that the findings 'rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.' It also noted that a fix has been developed and is available for websites to use.

Authorities have responded quickly to the news. The U.S. National Security Agency advised organizations that use PHP to 'maintain heightened awareness' in the coming weeks. The U.K.'s National Cyber Security Center urged organizations to 'take immediate action' and update their sites to the latest patched version. China's Industry Ministry called on entities to review their security gaps.

Several public-facing services have already been affected. Dozens of government websites in the United Kingdom and Finland were taken offline this week, and numerous local government sites in France were briefly pulled down as well. In Japan, Prime Minister Sanae Takaichi issued 'an urgent request for everyone to take action,' adding that if applying the patch promptly is difficult, 'temporarily suspending websites and similar measures can be considered an effective way to reduce risk.'

The volume of malicious activity targeting the flaws is growing rapidly. Matthew Prince, the head of the cybersecurity firm Cloudflare, reported that his company observed tens of thousands of attempts to exploit the flaw within 45 minutes of its discovery. By Thursday, he said, that figure had reached the millions.

Wiz Research reported that the flaws have existed in PHP for decades. Proving they could be exploited, however, 'required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.' The AI models, the firm said, have 'substantially reduced that barrier, turning a longstanding flaw into an exploit.'

This incident highlights the evolving role of artificial intelligence in cybersecurity. A few months ago, global alarm followed reports that autonomous agents had cheated on evaluations and then tried to cover it up, in what became known as the 'Hugging Face hack.' This week, by contrast, AI technology is credited with helping head off a wider global cybersecurity crisis.