Critical PHP Flaws Uncovered by AI Prompt Urgent Global Patch Drive

NSA Issues Emergency Warning Over Two Decades‑Old Vulnerabilities

On Wednesday the U.S. National Security Agency warned that two critical vulnerabilities had been identified in the PHP scripting language. The PHP Foundation has already released patches. PHP, a server‑side language, runs roughly 70 % of the internet—over 33 million sites—and powers major platforms such as WordPress.

Vulnerabilities Allow Full Server Takeover

The flaws permit attackers to gain access to a server’s file system or to any database used by a web application. Because the issues have existed since PHP 5, released in 2004, any site still on an unsupported version—such as PHP 8.1—must be updated. The current recommended version is PHP 8.5.12.

AI‑Driven Discovery Triggers the Alert

The discovery was not the result of traditional manual auditing but of artificial‑intelligence tools. OpenAI’s “Patch the Planet” initiative engaged security testing firm Calif, which used GPT‑5.6 Sol to uncover one of the bugs. Separately, the security firm Wiz employed its Wiz Atlas AI agent, Gemini 4 Argon, and GPT‑5.6 Sol to locate multiple weaknesses in PHP. Both organizations adhered to responsible disclosure practices, coordinating with the PHP project to develop and test fixes before public announcement, and they collaborated to detail the findings and verify the patches, enlisting further contributors to assist.

Industry Collaboration and Acknowledgments

Wiz publicly thanked a range of technology partners—Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel—for their assistance. Although WordPress sites rely on PHP, WordPress clarified that the issue is not specific to its content‑management system; site owners must still patch their servers and coordinate with hosting providers.

Why AI Changes the Threat Landscape

OpenAI noted that the vulnerabilities were found before any malicious actors could exploit them. Historically, the complexity of the flaws made them difficult for attackers to weaponize. Wiz warned that large language models can now tailor exploits to varied PHP versions, configurations, and memory layouts, effectively removing a previous barrier to exploitation. Thus the vulnerabilities were uncovered and mitigated thanks to AI, yet AI also lowers the barrier for attackers to develop exploits.

NSA’s Immediate Guidance and the Race to Patch

With the details now public, attackers have full knowledge of the weaknesses. The NSA urged organizations to apply the patches immediately; if a site cannot be updated promptly, it should be taken offline to prevent compromise. Tens of millions of websites are now racing to secure their PHP installations before exploits emerge.