The U.S. National Security Agency issued an urgent warning Wednesday about two critical vulnerabilities discovered in PHP. The agency advised that any website unable to apply patches immediately should be taken offline until the fixes are applied. PHP powers roughly 70 percent of websites on the internet, by some accounts more than 33 million sites, and is the foundation of popular content management systems including WordPress.
Flaws Present Since PHP Version 5
The vulnerabilities have existed in all versions of PHP since version 5, released in 2004. This means the flaws have been present for over two decades. PHP 8.1 and older versions are no longer supported, creating an urgent update path for many operators. The PHP Foundation has already issued patches, and the current recommended version is 8.5.12.
AI Security Research Uncovers Decades-Old Holes
Security firm Calif participated in OpenAI’s "Patch the Planet" initiative, using GPT-5.6 Sol to identify one of the flaws. The Wiz security team independently discovered multiple PHP vulnerabilities using its Wiz Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol. Both research groups followed responsible disclosure practices, coordinating with the PHP Foundation on patch development before any public announcement. Through collaborative effort, the groups refined their findings and validated the patches, involving additional industry participants in the process.
Industry Participants in the Fix
Wiz acknowledged Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel for their contributions. While WordPress sites rely on PHP, the WordPress project stated the issue is not specific to its platform; WordPress operators must coordinate with their web-hosting providers to ensure servers are patched.
AI Lowers the Barrier for Exploitation
OpenAI confirmed that the flaws were identified by researchers before malicious actors could discover them. Prior to AI-assisted research, these vulnerabilities were difficult enough to exploit that there were no reported instances in the wild. Wiz warned in its blog that large language models can now adapt exploits to different PHP versions, configurations, and memory layouts, meaning the risk profile has changed.
Urgency of Patching Across the Internet
With the details now public, the priority is for the internet to patch tens of millions of websites before attackers can target unpatched systems. The NSA guidance reflects this reality: if a PHP-powered site cannot be secured immediately, taking it offline is the recommended course of action until patches are applied.