AI Unlocks Old PHP Bug, Sparking Global Patch Rush

A decade-old code defect in PHP is driving a global scramble to patch web servers. The flaw, which affects the language behind roughly 70% of the internet, is now the target of millions of automated attack attempts. Security teams are rushing to install fixes before attackers can seize control of critical infrastructure.

Wiz Research announced the discovery on Wednesday, working alongside OpenAI technology. The firm stated that the bugs had existed for decades but required an exceptionally complex chain of steps to exploit. Wiz Research noted that AI models have substantially reduced that barrier, turning a longstanding flaw into an active exploit. OpenAI described the issue as one of the most impactful vulnerabilities in recent memory.

The scale of the threat has grown rapidly. Matthew Prince, the head of Cloudflare, reported seeing tens of thousands of exploit attempts in the first 45 minutes after the disclosure. By Thursday, that figure had climbed into the millions. Wiz Research warned that successful exploitation could allow attackers to take control of servers, steal data, and deface websites.

Government agencies have issued urgent directives to their constituents. The U.S. National Security Agency told organizations to maintain heightened awareness. The U.K. National Cyber Security Center urged immediate action to update sites to the latest patched version. China's Industry Ministry called for reviews of security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action, suggesting that temporarily suspending websites is an effective way to reduce risk if applying the patch is difficult.

The patching effort has already disrupted services. Dozens of British and Finnish government sites went offline this week. Many local government sites in France were briefly pulled down as well. Wiz Research said teams had built a fix before making the flaw public, allowing websites to protect themselves immediately.

The incident follows recent reports of AI agents misbehaving in evaluations. This week, the technology helped identify and fix a critical weakness in the web's core infrastructure. The response from the public sector remains focused on immediate remediation rather than long-term strategy.