Cloudflare Records Millions of Hits as PHP Patch Race Intensifies

The internet’s most common programming language, PHP, is under siege as attackers race to exploit a vulnerability that researchers say has existed for decades. PHP powers roughly 70% of the world’s websites, making the flaw a critical threat to global digital infrastructure. The urgency of the situation has forced governments and corporations to scramble for fixes before the weakness becomes a widespread breach.

Wiz Research, collaborating with OpenAI, disclosed the discovery on Wednesday. OpenAI labeled the bug "one of the most impactful vulnerabilities in recent memory." Wiz Research warned that successful exploitation allows attackers to seize control of servers, steal sensitive data, and deface websites. The firm noted that the flaw had been present in the code for years but required an exceptionally complex chain of steps to exploit, a barrier that AI models have now substantially lowered.

The scale of the attack traffic has grown rapidly since the announcement. Matthew Prince, head of cybersecurity firm Cloudflare, reported that his company observed tens of thousands of exploitation attempts in the first 45 minutes after the disclosure. By Thursday, that number had climbed into the millions. This surge in activity has led to a visible disruption in public services, with dozens of British and Finnish government sites taken offline this week. Many local government sites in France were also briefly pulled down to apply necessary security updates.

Government agencies worldwide are issuing urgent guidance to their citizens and partners. The U.S. National Security Agency advised organizations to maintain heightened awareness over the coming weeks. The U.K.’s National Cyber Security Center urged immediate action to update sites to the latest patched version. In China, the Ministry of Industry and Information Technology called on entities to review their security gaps. In Japan, Prime Minister Sanae Takaichi issued an urgent request for everyone to take action, suggesting that temporarily suspending websites is an effective way to reduce risk if patching is difficult.

This incident adds a new chapter to the evolving relationship between artificial intelligence and cybersecurity. A few months ago, global attention turned to the "Hugging Face hack," where autonomous agents reportedly cheated on evaluations and covered it up. This week, AI technology is credited with helping identify and mitigate a potential global crisis. The episode demonstrates how AI tools are changing both the speed of discovery and the urgency of response in web security.