The U.S. National Security Agency issued a warning on Wednesday that two critical flaws have been discovered in PHP, with patches already released by the PHP Foundation.
PHP is a server-side programming language used to power roughly 70% of websites on the internet. By some accounts, that figure exceeds 33 million sites. The language also supports popular content management systems like WordPress.
The agency stated that these flaws are so severe that any website unable to be patched immediately should be taken offline until the fix is applied. The vulnerabilities allow attackers to infiltrate the server’s file system or a database used by the web application.
These flaws have existed in all versions of PHP since version 5, which launched in 2004. Sites running older versions, including PHP 8.1 and below, are no longer supported. The recommendation is to update the web server to the current version, PHP 8.5.12.
Two such ubiquitous, decades-old flaws affecting nearly every website on the internet came to light suddenly because of AI, specifically through OpenAI and Google’s Wiz.
Security testing company Calif was engaged in OpenAI’s “Patch the Planet” initiative to find flaws in open source software. Using GPT-5.6 Sol, it identified one of the flaws, which OpenAI disclosed in a blog post. Separately, the Wiz team used AI, namely its Wiz Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol, to find multiple vulnerabilities in PHP.
Both OpenAI and Wiz followed responsible security research practices and worked with PHP on patches before publicly disclosing the flaws. They then collaborated to flesh out what they found and test the patches, drawing in a host of others to help.
Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel. While WordPress sites use PHP, WordPress has issued a statement saying that the flaw isn’t WordPress specific, and sites running its CMS must patch their servers and work with their web-hosting companies to ensure their sites are protected.
OpenAI says that these flaws were found by researchers before hackers discovered them. There were no reports of exploits in the wild. This is also in part because, before AI, these flaws were too hard for hackers to exploit. “With AI this is no longer a barrier. LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts,” Wiz warned in its blog about the flaws.
In other words, this is the kind of security issue that was found and prevented because of AI, but is also a high risk only because of AI.
Now that the issue has been disclosed, hackers are fully in the know. The race is on for the internet to patch tens of millions of websites before hackers can attack the unpatched ones. Hence the NSA’s guidance that if you can’t patch your PHP website right away, you’re better off pulling it offline until you can.
What it means
For developers and site owners, the immediate priority is checking the PHP version running on their servers. If the site is not on the latest supported release, the code must be updated to close the gap. Until that update is complete, taking the site offline is the safest option to prevent an intrusion. The situation highlights how artificial intelligence has lowered the barrier for finding and adapting exploits, turning old, dormant bugs into urgent threats.
