AI-Found Critical PHP Flaws Prompt Global Security Scramble, Outages and Millions of Exploit Attempts

Developers of the PHP programming language released urgent fixes on Wednesday for critical vulnerabilities that had gone undetected for years and were uncovered using artificial intelligence, urging all users to update immediately. Cloudflare CEO Matthew Prince said in a post on X that the company saw thousands of exploit attempts in the 10 hours before the public announcement, then tens of thousands within 45 minutes after it, hundreds of thousands within two hours, and millions afterward. Government websites in Europe and elsewhere went offline. Mitsubishi UFJ Financial Group suspended some internet services, and Japan's Finance Ministry paused some web content and services. Japanese Prime Minister Sanae Takaichi urged site owners to check whether they use PHP. Cybersecurity firm Wiz, whose researchers helped find the flaws, called them the most severe ever detected by AI; OpenAI, whose technology was used, called them one of the most impactful security issues in recent memory.

Right-leaning outlets had not reported the story at the time of writing, while left-leaning and alternative outlets had. Alternative sources (Investing.com, carrying Reuters; BBC News) focus on the attacks, outages, government responses and an explainer on PHP, quoting Prince, Wiz, OpenAI and Gorilla Cyber Security's Paul Spain. The left-leaning New York Times headline and excerpt stress AI's potential to upend cybersecurity unless shortcomings are addressed.