PHP flaw leads to millions of exploit attempts globally

Millions of Exploitation Attempts Hit Global Web Servers Following PHP Code Flaw

Websites around the world faced millions of intrusion attempts after cybersecurity researchers uncovered a critical flaw in the PHP programming language that underpins approximately 70% of the internet, cbc.ca reported. The vulnerability was discovered through artificial intelligence tools including OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon, according to collaborative disclosures by security firms Wiz, Calif, and the PHP Foundation.

Government agencies and major corporations temporarily took critical web infrastructure offline as a precaution. Similar preventative shutdowns affected government services in France, Japan, Denmark, Finland, and the Netherlands, CNN reported.

AI Tools Accelerate Discovery of Decade-Old Vulnerabilities

The underlying weaknesses had existed in the open-source code for a decade before researchers successfully chained them together using frontier AI models. Ryan Austin of security firm Calif explained that the flaw was key to discovering the issue.

Security firms compared the severity of the PHP vulnerabilities to major historical incidents. Wiz noted that the discovery parallels the 2014 Heartbleed bug, which exposed widespread shared encryption infrastructure across two-thirds of the web. Scoring 9.2 out of 10 on the Common Vulnerability Scoring System, the flaw allowed unauthenticated attackers to potentially read sensitive data or take control of underlying web servers.

Cloudflare and Security Agencies Track Massive Exploit Volumes

Cloudflare CEO Matthew Prince reported that the network recorded tens of thousands of exploit attempts within 45 minutes of the public announcement, scaling to hundreds of thousands within two hours and eventually reaching millions. Amazon Threat Intelligence confirmed that the vulnerability, designated as PHP2Shell, was actively tested by multiple threat actors before patches were officially issued.

The United Kingdom’s National Cyber Security Centre distributed approximately 50,000 alerts to affected organizations while confirming no reports of successful compromises.

Rapid Patch Deployment and Remediation Steps for Operators

The PHP Foundation released security updates on Wednesday to resolve the core engine weaknesses. Government entities, including the U.S. National Security Agency and Japan’s prime minister, urged immediate software updates, advising organizations unable to patch instantly to disconnect affected servers from the internet.

Isaac Privett, a senior penetration tester at Packetlabs, stated that remediation for website operators primarily requires upgrading to the newest secure version of PHP. Cybersecurity specialists also recommended that system administrators audit server logs for indicators of compromise that might have occurred prior to the patch installation.

Frequently Asked Questions About the PHP Vulnerability

What specific parts of the PHP code are affected by the flaw?

The vulnerabilities involve multipart request parsing and session upload-progress tracking.

Which prominent websites or services experienced disruptions?

Affected services included government portals in France, Japan, and the Netherlands, alongside corporate platforms such as Japanese airline ANA, railway operator JR West, and banking institution MUFG.

How can regular internet users protect themselves?

Consumers can safeguard personal accounts by practicing good password hygiene, avoiding password reuse, and activating multi-factor authentication across online services in case underlying platforms experience secondary data exposures.

More on this story: PHP team issues security update for remote code execution flaws · Cloudflare CEO: PHP flaws trigger millions of attacks