AI Tools Unearth Decades-Old Critical PHP Flaws
Original: PHP armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet
Why This Matters
Critical flaws in PHP affect ~70% of the web; AI both found and now elevates the exploit risk.
The NSA warned of two critical PHP vulnerabilities, present since PHP 5 (2004), found by OpenAI and Google's Wiz using AI. Patches are available; sites unable to patch should go offline immediately.
The U.S. National Security Agency issued an urgent warning Wednesday about two critical security flaws discovered in PHP, the server-side language powering roughly 70% of the web—an estimated 33 million sites, including those running WordPress. The vulnerabilities have existed in every PHP version since PHP 5, released in 2004, allowing attackers to infiltrate server file systems or connected databases.
The PHP Foundation has issued patches. The NSA recommends upgrading to PHP 8.5.12, the current version, immediately. Sites running unsupported versions (PHP 8.1 and older) face additional upgrade work. Sites that can't patch right away should be taken offline entirely, per the NSA's guidance.
Two separate AI-driven efforts surfaced the flaws. Security firm Calif, working under OpenAI's "Patch the Planet" open-source initiative, used GPT-5.6 Sol to find one vulnerability. Independently, Google's Wiz team deployed its Atlas security agent alongside Gemini 4 Argon and GPT-5.6 Sol to identify multiple PHP vulnerabilities. Both teams followed responsible disclosure practices, coordinating with the PHP Foundation before going public. Akamai, AWS, Cloudflare, Fastly, Microsoft, and Vercel were among those who assisted with testing and patch validation.
No exploits in the wild have been reported—researchers beat hackers to the discovery. However, Wiz issued a stark caveat: these flaws were previously too complex for attackers to exploit reliably across varied PHP configurations and memory layouts. AI changes that calculus. "LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts," Wiz warned. The same tools that found the bugs could now help bad actors weaponize them.