The flaws, which according to a Wiz blog post had sat hidden in the PHP codebase for more than a decade, could give an attacker a direct path to a server's file system or database, according to the US National Security Agency, which advised organisations to take systems offline if they could not patch immediately. The UK's National Cyber Security Centre gave similar advice and told organisations to check for backdoors installed by an attacker.

Games were caught up in the same precautionary shutdowns. Final Fantasy 14 temporarily disabled new logins while its patch servers received security updates, and although logins have been restored, the server back-up feature for players' save data remains offline. Umamusume: Pretty Derby was taken offline completely because its server-side infrastructure uses PHP, though its developer assured players no exploitation of the vulnerability had occurred; Japanese and global servers are back online, with a package of in-game currency sent to all players as compensation. Path of Titans, a dinosaur MMO still in beta, was taken down for up to three days as a precaution, with developer Alderon Games assuring players no data had been compromised.

The discovery has an unusually modern twist: multiple cybersecurity firms say they found the flaws with help from AI tools. OpenAI said it led a coalition of researchers that discovered the flaw, while Wiz said it used its own autonomous research tool alongside Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. The researcher who first reported the weakness, however, said they used publicly available models.

There are early signs the window before disclosure was not entirely quiet. Amazon's security chief CJ Moses said in a blog post that its team detected an attempt to exploit the vulnerabilities against one of its decoy honeypot systems on 17 October, four days before public disclosure, from an anonymous internet address. Moses said it was unclear how the actor learned of the flaws while they were under embargo.