Hacking attempts surge after flaws found in program affecting world’s websites: NPR
The PHP.net website homepage is visible on October 22, 2026 in Singapore. Cybersecurity vulnerabilities have recently been identified in the PHP programming language, used on a large number of websites around the world, including those of large companies and national governments. The PHP Foundation has released two patches designed to address the vulnerabilities.
Yong Teck Lim/Getty Images
hide caption
Yong Teck Lim/Getty Images
A few months ago, AI sparked a global alarm after autonomous agents cheated on assessments and then tried to cover up the affair, in what became known as the “Hugging Face hack.”
This week, AI and hacking return to the spotlight, with AI technology credited with helping prevent a global cybersecurity crisis.
Cybersecurity company Wiz Research, using OpenAI technology, announcement On Wednesday, the company discovered security flaws in a computer programming language that powers about 70 percent of the world’s websites.
OpenAI called the bug “one of the most significant vulnerabilities in recent memory.” Wiz Research warned that its “successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface websites running on them.”
Companies and governments from the UK to Japan are now racing to stop hackers from capitalizing on these flaws.
The flaws were discovered in a major programming language called PHP, short for Hypertext Preprocessor. Wiz Research considers PHP “the backbone of the web”, saying that this technology has underpinned much of the Internet since the 1990s.
“These findings are among the most serious vulnerabilities discovered in PHP, and arguably in the history of the software,” the company said, adding that before publicly disclosing the flaw, teams worked on creating a solution now available for websites to protect themselves.
As countries worked to prevent cyberattacks, many websites and pages have been taken offline in recent days. The US National Security Agency has warned organizations using PHP to “maintain increased vigilance” over the coming weeks. The UK’s National Cyber Security Center has called on organizations to “take immediate action” to update their websites to the latest patched or patched version.
Dozens of British and Finnish government services were taken offline this week. In France, many local government sites were also briefly closed. China’s Ministry of Industry has urged entities to examine security vulnerabilities.
In Japan, Prime Minister Sanae Takaichi turn off “an urgent request for everyone to act,” adding “While it is difficult to apply the patch quickly, temporary suspension of websites and similar measures can be considered an effective way to reduce risk.”
Matthew Prince, director of cybersecurity company CloudFlare, said His organization witnessed tens of thousands of attempts to exploit the flaw in the first 45 minutes after its discovery. It’s now in the millions, Prince said Thursday.
Wiz Research said the PHP flaws have been present for decades.
“But demonstrating their exploitability required an exceptionally complex chain of steps, at the limit of what human researchers could practically achieve,” the organization said. AI models have “significantly reduced this barrier, turning a long-standing flaw into an exploit.”
Gn headline
