Local
PHP security flaws trigger millions of reported attack attempts
Researchers disclosed serious vulnerabilities in PHP, a programming language used by about 70% of the world’s websites, and attackers rapidly began trying to exploit them. The PHP Foundation released fixes as governments and businesses urged site operators to update or temporarily take vulnerable sites offline.
Security researchers say attackers have made millions of attempts to exploit newly disclosed vulnerabilities in PHP, a programming language used by roughly 70% of websites worldwide. The flaws could let intruders take control of affected servers, access sensitive data or alter websites, according to cybersecurity firm Wiz Research.
Wiz said it found the vulnerabilities with help from OpenAI technology and announced them Wednesday, Oct. 21. The flaws had existed for decades, the firm said, but exploiting them required a complicated series of steps that AI tools helped researchers identify. OpenAI called the issue among the most consequential vulnerabilities in recent memory.
The PHP Foundation released two patches to address the problems. U.S. organizations using PHP were advised by the National Security Agency to remain especially alert in the coming weeks. The United Kingdom’s National Cyber Security Center urged organizations to update to a corrected version immediately.
Cloudflare CEO Matthew Prince said his company recorded tens of thousands of attempts to exploit the flaws in the first 45 minutes after they became known, rising to millions by Thursday. The figure reflects attempts observed by Cloudflare, not a confirmed count of successful intrusions.
The response has included temporary shutdowns. Dozens of government services in Britain and Finland went offline this week, and local government websites in France were briefly taken down. China’s industry ministry urged organizations to assess their security. Japan’s Prime Minister Sanae Takaichi called for urgent action, saying sites could be suspended temporarily if fixes could not be applied promptly.
PHP, short for Hypertext Preprocessor, has powered websites since the 1990s and is used by major companies as well as public agencies. That broad reach means the risk extends beyond individual businesses: government and community services that depend on websites may also need to patch systems or limit access while doing so.