The US National Security Agency issued an alarming warning Wednesday that two critical holes have been discovered in PHP, and patches have already been issued by the PHP Foundation.
PHP is a server-side programming language that is widely used for web applications, being used by approximately 70% of websites on the Internet. According to one theory, the number is over 33 million sites. It is also used by popular content management systems such as WordPress.
The NSA warned that these holes are so serious that if your website cannot be patched immediately, it should be removed from the web until it is patched. This hole allows an attacker to penetrate the server’s file system or databases that the web app might use.
Interestingly, these holes have been hidden in every version of PHP since version 5, released in 2004. PHP versions earlier than 8.1 are no longer supported, so websites that aren’t running a newer version of PHP will need to update. We recommend updating your web server to the current version of PHP (8.5.12).
So how did two decades-old, ubiquitous flaws that affect nearly every website on the internet suddenly come to light? AI, specifically via OpenAI and Google’s Wiz, of course.
Security testing firm Calif was involved in OpenAI’s “Patch the Planet” initiative to find flaws in open source software. With GPT‑5.6 Sol, one of the flaws, OpenAI, was revealed in a blog post. Separately, the Wiz team discovered multiple vulnerabilities in PHP using AI, namely Wiz Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol.
Both OpenAI and Wiz followed responsible security research practices and worked with PHP to create a patch before disclosing the flaw. Then we all worked together to flesh out our findings and enlisted the help of many others to test the patch.
Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel. (Although WordPress sites use PHP, WordPress issued a statement saying that this flaw is not unique to WordPress and that sites running the CMS should patch their servers and work with their web hosting companies to ensure their sites are protected.)
OpenAI says these flaws were discovered by researchers before hackers did. Therefore, there were no reports of actual exploitation. This is partly because, before the advent of AI, these flaws were too difficult for hackers to exploit. “With AI, this is no longer a barrier. LLM helps adapt exploits to different PHP versions, configurations, and memory layouts,” Wiz warned about the flaw on his blog.
In other words, this is a security issue that could have been discovered and prevented thanks to AI, but it’s also a high risk because of AI.
Now that this issue has come to light, hackers are fully aware. The race is on to patch the tens of millions of websites on the Internet before hackers attack unpatched websites. Therefore, the NSA provides guidance that if you cannot patch your PHP website right away, you should take it offline until you can.
If you make a purchase through links in our articles, we may earn a small commission. This does not affect editorial independence.
