What changed
The U.S. National Security Agency (NSA) issued an alarming warning about two critical vulnerabilities in PHP, which are so severe that websites unable to patch them immediately should be taken offline. These flaws, found using AI tools from OpenAI and Wiz, affect nearly every website on the internet, as PHP powers over 70% of websites, including those using WordPress.
What this means in practice
The vulnerabilities allow attackers to infiltrate a server’s file system or database used by a web application. The NSA recommends updating to PHP 8.5.12, as versions 8.1 and older are no longer supported. The flaws were discovered through AI-driven security testing initiatives, including OpenAI’s 'Patch the Planet' and Wiz’s use of its Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol. Both companies followed responsible disclosure practices, working with PHP developers to create patches before public disclosure.
Limitations and availability
The vulnerabilities have existed in all PHP versions since 2004, making them particularly dangerous as they affect a vast number of websites. While WordPress has stated the flaws are not specific to its CMS, users must patch their servers and work with their web-hosting providers. OpenAI and Wiz emphasized that AI made these flaws exploitable for the first time, and now that they are public, the risk of exploitation has increased. The NSA’s guidance highlights the urgency of patching to prevent potential attacks.
