Two severe security vulnerabilities embedded in PHP since 2004 were uncovered and patched following AI-assisted discovery efforts led by OpenAI and Google’s Wiz, prompting urgent warnings from the U.S. National Security Agency.
- Critical PHP flaws date back to version 5, released in 2004.
- AI tools such as GPT-5.6 Sol and Wiz Atlas enabled rapid flaw detection and patch development.
- NSA advises sites to update or go offline until secured.
What happened
The U.S. National Security Agency issued an urgent alert after security researchers using AI tools discovered two critical vulnerabilities in PHP, a server-side language powering roughly 70% of the internet’s websites. These flaws, present in every PHP version since 5 (launched in 2004), allow attackers potential access to server file systems and databases backing web applications. Because many sites run outdated PHP versions no longer supported, mass updates are necessary.
OpenAI’s Patch the Planet initiative and Google’s Wiz security teams independently utilized AI models—including GPT-5.6 Sol and Wiz Atlas—to identify these hidden flaws. After responsible disclosure to the PHP Foundation, patches have been released. Collaboration among the AI teams and major internet infrastructure providers ensured thorough validation and rollout of fixes.
Why it matters
PHP’s widespread use across more than 33 million websites, including major content management systems like WordPress, means these vulnerabilities pose a significant global cybersecurity threat. If left unpatched, attackers can exploit these weaknesses to gain unauthorized server control or access sensitive information. The NSA’s strong recommendation to immediately patch or temporarily disable vulnerable sites underlines the severity.
This situation highlights a paradox where AI accelerates both the discovery of critical security flaws and the potential creation of exploits. Previously difficult to exploit vulnerabilities are now easier to manipulate with AI-driven adaptation, raising the stakes for rapid remediation and ongoing vigilance within the web ecosystem.
What to watch next
The immediate focus will be on the internet community’s ability to update tens of millions of PHP-powered sites to the supported PHP 8.5.12 version or higher. Hosting providers, CMS platforms, and security teams will play key roles in coordinating swift patch deployment and mitigating potential attack windows on unpatched servers.
Longer term, this incident will likely drive broader adoption of AI-assisted security research while emphasizing the need for continuous AI oversight to prevent new risks. It also underscores the importance of maintaining current software versions to avoid exposure to longstanding but hidden vulnerabilities.