Widespread PHP Vulnerabilities Prompt Global Cybersecurity Alerts

Security firm Wiz Research announced on Wednesday that it had identified critical vulnerabilities in PHP, the programming language that powers an estimated 70 percent of the world’s websites. The firm, which employed OpenAI technology for its analysis, said the flaws could allow attackers to seize control of servers, exfiltrate data and deface sites.

"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history," Wiz Research said, noting that a fix had been developed and was now available for deployment.

Governments and agencies across multiple continents have issued rapid advisories. The U.S. National Security Agency urged organizations using PHP to maintain heightened awareness in the coming weeks. The U.K.’s National Cyber Security Centre called for immediate updates to patched versions, while Japan’s Prime Minister Sanae Takaichi issued an urgent request for action, suggesting temporary suspension of vulnerable sites if patches cannot be applied promptly. Similar alerts were issued by China’s Industry Ministry and other national bodies.

The discovery has already triggered a surge in exploitation attempts. Matthew Prince, CEO of Cloudflare, reported tens of thousands of exploitation attempts within the first 45 minutes of the flaw’s disclosure, rising to millions shortly thereafter.

Wiz Research indicated that the PHP vulnerabilities had existed for decades, underscoring the importance of timely security updates across the internet’s infrastructure.