AI explosion of PHP vulnerabilities triggers a global wave of cyber attacks: Why is the impact so widespread?

The PHP development team released an emergency security update on Wednesday (October 21) to fix serious vulnerabilities that have been hidden in the software for many years, and called on all users to upgrade immediately. Cybersecurity companies warn that some hackers have begun exploiting these vulnerabilities to launch attacks.

PHP was born in the early 1990s. It is a programming language widely used to run websites. It is also an important part of website systems such as WordPress, Drupal, Joomla and Magento. Due to the wide range of PHP applications, any serious vulnerability may have a huge chain reaction.

Tiffany Faris, acting CEO of the Drupal Association, said the vulnerability exists in all versions of PHP released over the past 20 years, adding that the issue "affects the vast majority of websites on the Internet."

Cybersecurity agencies globally have urged PHP users to install updates immediately and, if necessary, temporarily shut down websites until patches are completed.

Data from internet intelligence firm Censys shows that of the 2.6 million hosts reported to be running PHP, about 1.5 million are still using versions that don't yet have fixes.

Large areas of global service outage

Tencent Cloud, one of China's largest cloud computing service providers, urged customers to install an updated version of PHP but stopped short of further calling for widespread website closures.

Japan's Nomura Securities, Mitsubishi UFJ Financial Group, ANA and East Japan Railway Company said on Thursday that they would temporarily suspend some Internet services as an emergency measure. The Ministry of Finance and the Meteorological Agency of Japan have partially suspended online services to implement safety measures; the National Tax Agency of Japan has also temporarily closed related services.

French telecom group Orange said that as a precautionary measure, it has temporarily suspended access to some PHP-based websites and applications of several of its subsidiaries.

Many European countries and institutions have taken preventive measures. The National Cyber ​​Security Center of the Netherlands was temporarily offline, and the Port of Rotterdam, the government portal Overheid.nl, the Royal Dutch Football Association, the official websites of the country's five major political parties, and the websites of many hospitals were also shut down. The operator of the online encyclopedia Wikipedia said it has shut down some systems and will reopen them after security patches are completed.

Danish municipal information technology company Kombit has shut down a number of services, including its national school communications platform. Finland's national IT services provider Valtori said government public network services had been taken offline "as a precautionary measure". The French government's Ministry of the Interior has put all websites into preventive maintenance.

The Dutch Prime Minister said he was paying close attention to developments. Japanese Prime Minister Takaichi Sanae also reminded website owners on social platform X to check whether running websites use PHP and be prepared to install new patches.

AI finds vulnerabilities that have been dormant for years

The two network security companies stated in separate reports that the relevant PHP vulnerabilities were discovered with the help of artificial intelligence.

Internet security company Calif said it discovered the vulnerability on August 1 with the help of a large language model and has been working on developing a fix since then.

Wiz, a network security company owned by Google parent company Alphabet, said that it discovered these vulnerabilities using its own artificial intelligence vulnerability research tool Wiz Atlas, as well as Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol.

"Exploit Contest"

Wiz pointed out that the relevant vulnerability has been hidden in the PHP code base for more than ten years. In the past, human researchers had to do a lot of work to discover and exploit these vulnerabilities, but AI has significantly lowered this threshold.

The company said: "Before the advent of artificial intelligence, this type of manual operation was difficult to implement and even harder to carry out at scale. AI breaks this barrier."

Technology companies have warned that hackers are exploiting these vulnerabilities. Since the fix patch has been made public and AI tools can easily reverse engineer the vulnerability, experts predict that hackers will rush to launch attacks before the system update is completed.

Costin Reu, co-founder of TLP:Black, a cybersecurity research and incident response organization, said that artificial intelligence is driving a "vulnerability exploitation race", and the next step may be that all vulnerable network servers on the Internet are compromised on a large scale.

PHP covers a large number of websites and has a wide impact

PHP is a programming language used to run websites, free and open source. When a visitor loads a page, the server running PHP generates the page content and sends it to the browser.

According to data from W3Techs, a web technology tracking organization, about 75% of websites that recognize programming languages ​​​​use PHP. Its widespread use worries cybersecurity experts, especially as hacker attacks using artificial intelligence have increased in recent years.

Lukasz Oleinik, a visiting senior fellow at King's College London, said servers that had not yet been patched could suffer serious damage. He warned that the potential impact was huge and that AI could allow vulnerabilities to be exploited in a very short period of time.

However, not all PHP websites face the same risk. Automattic, the operator of WordPress.com, said that users of its hosting service and Tumblr users are not affected by the vulnerability. In contrast, small PHP websites run by limited personal or technical resources are at higher risk. These websites often use shared hosting services, where the customer does not directly manage the underlying server.

Some system repairs may take weeks

On Thursday (October 22), many Asian governments ordered network security inspections related to PHP vulnerabilities.

China's Ministry of Industry and Information Technology urges organizations and users to check their systems and upgrade to the latest secure version of PHP. The Ministry of Industry and Information Technology also recommends strengthening network security monitoring and changing accounts, passwords and keys when necessary.

South Korea has raised its cyber security alert level for the private sector and initiated emergency response measures, citing concerns about the rising risk of hacker attacks.

Felix Kulenkamp, ​​head of security affairs at Bitkom, the German Digital Industry Association, said that many larger operators have completed the update, but for complex IT systems and smaller organizations, repairs may take longer.

"They may be running a website using PHP and not paying close attention to how it's running," he said.

He added: "If a website is still running on an older version of PHP and no security updates are available for that version, the entire system must be upgraded."