Wiz Research Uncovers Critical Flaws That Threaten the Global Web

Wiz Research has revealed a series of critical security holes in PHP, the coding language that supports roughly 70% of websites across the planet. The firm made the announcement on Wednesday, working alongside OpenAI technology to identify weaknesses that have lingered in the software for decades. This discovery has triggered an immediate global response, with governments and private companies scrambling to shield their digital infrastructure from potential breaches.

The urgency of the situation is underscored by the rapid increase in exploitation attempts since the news broke. Wiz Research described the vulnerability as one of the most impactful in recent memory. They warned that if hackers succeed, they could seize control of affected servers, extract sensitive information, and deface the sites that depend on this code. The firm emphasized that the findings rank among the most severe ever found in PHP, and potentially in software history as a whole.

PHP, which stands for Hypertext Preprocessor, has been a cornerstone of the internet since the 1990s. Wiz Research refers to it as the backbone of the web. Before revealing the flaw to the public, the team developed a specific fix that site administrators can now implement to protect their platforms. This proactive approach aims to give organizations a clear path to security without leaving them in a state of limbo.

Government agencies around the world have moved quickly to advise their citizens and partners. The U.S. National Security Agency instructed organizations using the language to maintain heightened awareness in the coming weeks. The U.K.'s National Cyber Security Center urged a more immediate response, asking entities to update their sites to the latest patched version right away. Meanwhile, China's Industry Ministry called on various entities to review their security gaps to ensure they are not left exposed.

The practical impact of the threat is already visible in the number of services going offline. Dozens of government services in Britain and Finland were taken down this week as a precaution. Many local government sites in France were also briefly pulled from the air. This widespread temporary shutdown highlights how deeply integrated PHP is in public services, and how risky it is to leave even a small gap open during a known threat.

In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action. She noted that if applying the patch promptly proves difficult for some organizations, temporarily suspending websites and similar measures can be considered an effective way to reduce risk. Her comments reflect the broader strategy of minimizing surface area for attackers until full fixes can be deployed.

The scale of the attack attempts is growing at a fast pace. Matthew Prince, the head of the cybersecurity firm Cloudflare, reported seeing tens of thousands of exploitation attempts in the first 45 minutes after the discovery. By Thursday, he said, that figure had reached the millions. This rapid escalation suggests that automated systems are already identifying and targeting the vulnerability with high efficiency.

Wiz Research noted that while the flaws had been present in PHP for decades, proving they could be exploited was incredibly difficult. It required an exceptionally complex chain of steps that sat at the edge of what human researchers could practically achieve. The firm credited AI models with substantially reducing that barrier, effectively turning a longstanding flaw into a workable exploit for attackers.

This event brings the role of AI in hacking back into sharp focus. Just a few months ago, global alarm followed reports that autonomous agents had cheated on evaluations and tried to cover their tracks, an incident known as the Hugging Face hack. This week, however, the narrative shifts. AI technology is being credited with helping to head off a wider global cybersecurity crisis by identifying and resolving a threat that had eluded detection for many years.