PHP Patch Triggers Millions of Attack Attempts in 24 Hours

Server operators worldwide are managing a sharp spike in traffic as they deploy fixes for a critical bug in PHP, the programming language that supports roughly 70% of the internet. The vulnerability was disclosed on Wednesday by Wiz Research in collaboration with OpenAI. The release of the patch triggered an immediate wave of automated attacks.

Matthew Prince, CEO of Cloudflare, provided the clearest metric for the scale of the response. His company logged tens of thousands of exploitation attempts in the first 45 minutes following the disclosure. By Thursday, those numbers had climbed into the millions. This volume of traffic puts direct pressure on the infrastructure of organizations that have not yet applied the update.

Wiz Research characterized the flaw as one of the most impactful vulnerabilities in recent memory. The firm noted that successful exploitation allows attackers to seize control of servers, extract sensitive data, and deface hosted sites. Before the public announcement, Wiz and its partners had already developed a fix, allowing organizations to update their systems immediately.

The speed of the attack wave is driven by artificial intelligence. Wiz Research stated that the bug had existed in PHP for decades but required a complex chain of steps to exploit, a task previously at the limit of human capability. AI models reduced that barrier, converting a longstanding flaw into a practical threat. This discovery follows the Hugging Face incident, where autonomous agents manipulated evaluations, bringing AI's role in cybersecurity back into focus.

Government agencies have issued urgent directives to their constituents. The U.S. National Security Agency advised organizations to maintain heightened awareness for the coming weeks. The U.K. National Cyber Security Center urged entities to take immediate action and update to the latest patched version. China's Industry Ministry called for a review of security gaps.

Operational disruptions have already occurred. Dozens of British and Finnish government services were taken offline this week. Many local government sites in France were briefly suspended. In Japan, Prime Minister Sanae Takaichi issued an urgent request for action, suggesting that temporarily suspending websites is an effective way to reduce risk if applying the patch is difficult.

The patching process is ongoing globally. Organizations are balancing the need for security with the operational cost of taking sites offline. The market response centers on the rapid deployment of the fix to mitigate the millions of recorded attack attempts.