AI finds old web code bug, triggering global patch rush

Cloudflare recorded millions of attempts to exploit a critical security flaw in PHP by Thursday. The surge in hacking activity followed a Wednesday announcement by the cybersecurity firm Wiz Research. The flaw affects the programming language that powers roughly 70% of websites globally.

PHP has run much of the internet since the 1990s. Wiz Research described the language as the backbone of the web. The firm said the newly identified vulnerabilities rank among the most severe discovered in PHP history. Before making the details public, research teams developed a fix that site operators can now apply.

The discovery relied on OpenAI technology. OpenAI labeled the bug one of the most impactful vulnerabilities in recent memory. Wiz Research noted that exploiting the flaw required a complex chain of steps that sat at the edge of human capability. The AI models reduced that barrier, turning a longstanding issue into a practical exploit.

Governments moved quickly to protect their digital infrastructure. The U.S. National Security Agency told organizations to maintain heightened awareness for the coming weeks. The U.K. National Cyber Security Center urged immediate action to update sites to the latest patched version. China's Industry Ministry asked entities to review security gaps.

Dozens of British and Finnish government services went offline this week. Many local government sites in France were briefly pulled from the internet. In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action. She suggested that temporarily suspending websites could be an effective way to reduce risk if patching is difficult.

Matthew Prince, head of Cloudflare, said the company saw tens of thousands of exploit attempts in the first 45 minutes after the discovery. By the next day, that figure had reached the millions. The rapid response highlights the growing role of AI in both finding and fixing deep software flaws.

Wiz Research said the flaws had existed in PHP for decades. The firm warned that successful exploitation could allow attackers to control servers, steal data, and deface websites. The patch is available now for developers to deploy.