Governments and companies worldwide are racing to patch websites or taking them offline after discovering major security flaws in PHP, the open-source language powering an estimated 70 percent of all websites. Open AI revealed the vulnerability was discovered using its GPT-5.6 Sol model, calling it one of the most impactful security issues in recent memory. The flaw, hidden in PHP for years, was independently reported by researchers at Wiz, an Israeli-American security firm owned by Google.
Security professionals warn that hackers could exploit unpatched systems to manipulate operations and steal private data. The discovery highlights the dual-use capabilities of advanced AI tools in cybersecurity. The situation was complicated by a leak of technical details on a hacker forum, which prompted the PHP foundation to release a fix ahead of schedule.
Amazon reported that an unknown actor attempted attacks using the vulnerability four days before the official patch release against a decoy system. The identity of the attacker remains unknown, but early activity suggests hackers were preparing exploits prior to disclosure. Matthew Prince of Cloudflare noted thousands of attempts to exploit the flaw, underscoring the widespread risk to internet infrastructure reliant on PHP.
Source: New York Times Business · Summarized by HeadlinesBriefing