Wiz Research Discovers Critical PHP Flaws, Triggering Global Patching Efforts

Global internet infrastructure is undergoing a rapid defensive shift after researchers identified severe vulnerabilities in PHP.

The cybersecurity firm Wiz Research announced the discovery on Wednesday. The team utilized OpenAI technology to locate the bugs. OpenAI labeled the issue one of the most impactful vulnerabilities in recent memory. Wiz Research stated that successful attacks could grant control over servers, steal data, and deface websites.

PHP, or Hypertext Preprocessor, has supported much of the internet since the 1990s. Wiz Research described the language as the backbone of the web. The firm ranked the findings among the most severe vulnerabilities discovered in PHP and arguably in software history. Teams developed a fix before disclosing the flaw to the public.

Government agencies responded with immediate directives. The U.S. National Security Agency advised organizations to maintain heightened awareness. The U.K. National Cyber Security Center urged immediate action and updates to the latest patched version. China's Industry Ministry called for reviews of security gaps. Prime Minister Sanae Takaichi of Japan issued an urgent request for action, noting that temporarily suspending websites can reduce risk if patching is difficult.

The financial and operational impact is already visible. Dozens of British and Finnish government services went offline this week. Many local government sites in France were also briefly pulled down. Matthew Prince, head of Cloudflare, reported that his company saw tens of thousands of exploitation attempts in the first 45 minutes after the announcement. By Thursday, that figure reached the millions.

Wiz Research indicated the flaws had existed in PHP for decades. Proving exploitability required a complex chain of steps that was at the edge of human practical achievement. The firm said AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.