Two severe PHP vulnerabilities were revealed Wednesday, and the PHP maintainers shipped fixes the same day with a push to update immediately. Because the bugs could let attackers seize control of affected sites, many organizations took services offline during patching.
Governments and organizations in Austria, the Netherlands, Finland, France, Denmark, Australia, Canada, Germany, Japan and Belgium pulled services on Wednesday while updates were applied. In the US, the White House worked on the issue alongside federal agencies and companies running critical infrastructure. Across Europe, Asia and the Americas, financial institutions, airlines and government bodies took similar steps to curb exposure.
Japan experienced several service stoppages: Mizuho Financial Group Inc.'s banking and securities units suspended operations and announced emergency security measures; Shizuoka Bank took its website and app offline; and certain online services at companies within Mitsubishi UFJ Financial Group Inc. were put on hold. Orange, the telecommunications operator, said Thursday it was suspending access to parts of its websites and apps while it rolled out security patches for the vulnerabilities.
Wiz said the PHP weaknesses had been hidden for more than a decade. Its researchers used several AI systems to pinpoint the flaws and worked with OpenAI and cybersecurity firm Calif on the effort. As their report put it, "With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work."
Amazon.com Inc. researchers reported that an unknown "threat actor" tried to exploit the bugs before public details emerged, indicating some information leaked ahead of disclosure.
When tech vulnerabilities can affect many services, it's helpful to stay informed, so sign up for the free Market Briefs newsletter.
Cloudflare Inc. CEO Matthew Prince said on X the company saw thousands of exploit attempts 10 hours before the flaws were made public. Two hours after disclosure, attempts jumped into the hundreds of thousands and later into the millions. "Literally, we're seeing millions of attempted attacks using this flaw now across all of our network every single minute of every single day," he told Bloomberg TV on Thursday. It is not clear how many of those, if any, succeeded.
PHP powers nearly 70% of the websites where W3Techs could identify the programming language. Palo Alto Networks Inc. researcher Lee Klarich counted more than 22 million internet-exposed PHP instances, spanning servers, databases and applications. More than a third of those at-risk systems run legacy software that cannot be patched, said Jack Hughes, who heads EMEA digital forensics and incident response at Palo Alto Networks' Unit 42.
Critical bugs are being found faster as AI combs through code. The US National Vulnerabilities Database says 2026 is on track to roughly double 2025's known vulnerability count. Yet there is little sign that successful attacks are climbing at the same pace. In July, 401 of 433 Chrome vulnerabilities were reported by Google itself, and the US Known Exploited Vulnerabilities repository has not shown a meaningful uptick in confirmed attacks. Still, speed matters: the period between disclosure and patching is crucial, cautioned NCC Group's Matt Hull, who serves as vice president for cyber intelligence and response, adding, "There is a real possibility that vulnerable systems could already have been compromised, including the creation of backdoors."
Taking services offline limits the chance an attacker can hit a live target while teams patch, but it also disrupts operations. For companies heavily dependent on web services, watch for short outages, how fast they apply fixes, and whether any rely on unpatchable legacy systems. The broader signal for investors: AI is accelerating bug discovery, so expect more frequent disclosures and rapid patch cycles that test operational resilience.
In a world where quick fixes matter, get concise context each morning by subscribing to Market Briefs, our free newsletter.
