Business
PHP Security Flaws Trigger Millions of Exploit Attempts as Governments Urge Updates
Security researchers say newly exposed flaws in PHP could let attackers seize servers and steal data, putting businesses and public agencies at risk. Cloudflare reported that attempts to exploit the bugs surged from tens of thousands to millions as governments urged operators to patch vulnerable systems.
Organizations worldwide are scrambling to secure websites after researchers uncovered serious vulnerabilities in PHP, a programming language used by an estimated 70% of the world’s websites.
The PHP Foundation has released two patches to address the flaws. The vulnerabilities could allow attackers to take control of affected servers, steal sensitive information or alter websites, according to cybersecurity firm Wiz Research, which identified them with assistance from OpenAI technology.
The vulnerabilities had existed for decades, Wiz said, but exploiting them required a complex sequence of steps that had been difficult for human researchers to carry out. AI tools lowered that barrier, the firm said, turning a longstanding weakness into a usable attack method.
The warning has prompted urgent action across government and industry. The U.S. National Security Agency advised organizations using PHP to remain especially alert in the coming weeks. Britain’s National Cyber Security Centre told organizations to update to a fixed version immediately.
Government services in Britain and Finland were taken offline this week, while local government websites in France were briefly disrupted. China’s Industry Ministry urged organizations to review their security gaps. Japan’s Prime Minister Sanae Takaichi called for urgent action and said temporarily suspending websites could reduce risk if operators could not apply the fix promptly.
The scale of the threat became clear quickly. Cloudflare chief executive Matthew Prince said the company detected tens of thousands of exploitation attempts in the first 45 minutes after the flaw was disclosed; by Thursday, he said, attempts had reached the millions.
PHP, short for Hypertext Preprocessor, has powered websites since the 1990s and is used by major companies and national governments. The incident underscores how a flaw in widely deployed infrastructure can expose businesses and public services across borders—and why operators must install security updates promptly rather than wait for an attack to reach them.