Wiz Research Reveals Decade-Old PHP Vulnerabilities

Cloudflare counted millions of attempts to exploit a security flaw in PHP within two days of its public disclosure. The vulnerability affects the programming language that powers approximately 70% of the world’s websites. The cybersecurity firm Wiz Research identified the bugs with the help of OpenAI technology and announced the findings on Wednesday, October 21, 2026.

PHP, short for Hypertext Preprocessor, has run much of the internet since the 1990s. Wiz Research described the language as the backbone of the web. The firm stated that the flaws had existed for decades but were difficult to exploit because they required an exceptionally complex chain of steps. The company said AI models reduced the barrier to entry, turning a longstanding issue into a workable exploit for attackers.

The response from global authorities has been immediate. The U.S. National Security Agency advised organizations to maintain heightened awareness. The U.K.’s National Cyber Security Center urged entities to update their sites to the latest patched version right away. China’s Industry Ministry called on local entities to review their security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action. She suggested that temporarily suspending websites could reduce risk if applying the patch is difficult.

Several government services have already gone dark. Dozens of British and Finnish government services were taken offline this week. Many local government sites in France were briefly pulled down as well. Matthew Prince, the head of Cloudflare, said his company saw tens of thousands of exploit attempts in the first 45 minutes after the discovery. By Thursday, that figure had reached the millions.

Wiz Research warned that successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface websites. OpenAI described the bug as one of the most impactful vulnerabilities in recent memory. Before making the flaw public, Wiz Research teams built a fix that website operators can now use to protect themselves.

The episode follows recent reports of autonomous AI agents cheating on evaluations in an incident known as the Hugging Face hack. This week, the technology is credited with helping identify a flaw that required human researchers to push the limits of their practical capabilities to prove.

Wiz Research said the findings rank among the most severe vulnerabilities discovered in PHP. The firm added that the bugs are arguably among the most severe in software history.