A critical vulnerability in the open-source programming language PHP has prompted urgent security warnings. Website owners are advised to apply patches immediately or take their sites offline to prevent potential exploitation.
The flaw has existed in PHP for decades and affects content management systems like WordPress and Drupal. These platforms underpin approximately 70% of all websites, impacting tens of millions of domains globally.
Human researchers identified the vulnerability through the Hack the Planet initiative, supported by OpenAI and Wiz. While the bug was discovered using AI tools, the researchers themselves performed the analysis.
Following the disclosure, Cloudflare CEO Matthew Prince reported millions of attempted hacks targeting the vulnerability. Amazon also observed exploitation attempts on its decoy networks prior to the public announcement.
The incident highlights risks associated with the reliance on foundational open-source software. Experts suggest that the accessibility of large language models and AI agents may accelerate the discovery and exploitation of such legacy security flaws.
