Two decades-old PHP vulnerabilities are severe enough that roughly 70 percent of websites need to update core software, exploits are already live, and researchers call them among the worst in software history.
Quite a few websites will be serving error pages today. Not because they were hacked, but because the ground under them has a hole in it.
Seventy percent of the web stands on the same floor
PHP is a programming language, and WordPress, Drupal, Joomla and Magento all run on it. PHP pushed out an emergency update fixing two bugs that let an attacker run code of their choosing on a vulnerable server.
Censys, which tracks internet hosts, counted about 2.58 million internet-facing servers and 54.9 million web properties running PHP. Wiz says every PHP version released in the past decade is hit by at least one of the flaws, and everything from 5.4 onward is affected.
A decades-old bug, cracked open by AI
Wiz researchers say the underlying flaws sat there for decades, but turning them into a working attack took an exceptionally complex chain of steps, right at the edge of what human researchers could do. Frontier AI models cut that barrier down, and a long-dormant flaw became a ready-made exploit.
Cloudflare has already seen exploitation attempts and at 3:02 am UTC switched on firewall rules to block the traffic. Reuters reports government sites in Europe and elsewhere went offline. OpenAI, which took part in the research and disclosure, called it one of the most impactful security issues in recent memory.
Patches are out; patching is not done
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The trouble is PHP sits so deep that it spans clouds, hosting providers, CDNs and millions of independently managed servers. Wiz compares it to Log4Shell in 2021: as severe as it gets, and scattered everywhere.
What to do now
If you run a site, check whether your host has pushed a PHP update; Ubuntu has already shipped new packages. If you are just a visitor, a site that will not load today is probably not your connection.
Why it matters
AI has lowered the bar for finding vulnerabilities from elite human researchers to something a model can grind through, which means old flaws tolerated because they were 'too hard to exploit' will turn into working attacks in batches. Whether patching can keep up is the real test ahead.
Curated from high-quality sources, with concise summaries and key takeaways.
