AI tools uncover decades-old PHP flaws, prompting urgent patches
Researchers using AI from OpenAI and Google's Wiz found two critical vulnerabilities that had existed in PHP since version 5, affecting a large share of websites. The NSA warned that unpatched systems should be taken offline, and the PHP Foundation has released fixes. The flaws were disclosed responsibly after patches were prepared, with no known exploitation in the wild.
The NSA alert followed PHP Foundation fixes for two critical PHP flaws. PHP powers about 70% of websites—over 33 million by some counts—and supports WordPress. The bugs could expose a server’s file system or associated database and have existed since PHP 5 in 2004. PHP 8.1 and older are unsupported; 8.5.12 is current.
Calif, in OpenAI’s Patch the Planet, used GPT-5.6 Sol to find one flaw; Wiz’s Atlas agent used Gemini 4 Argon and GPT-5.6 Sol. Both coordinated with PHP before disclosure. Wiz credited Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel. WordPress said the issue is not CMS-specific, but servers and hosts need patching.
The disclosure may affect millions of site operators, hosting providers, and businesses relying on PHP-based sites, including WordPress users. Organizations that delay patching could face data exposure or service disruption if attackers learn to exploit the flaws. Because AI may make adapting exploits easier, smaller teams with limited security resources could be especially exposed. The NSA’s advice to take unpatched systems offline may prompt short-term website outages, but could also reduce risk while updates are applied.