Earlier today, the U.S. National Security Agency alerted website operators to two critical security holes discovered in PHP—one of the world’s most pervasive server-side scripting languages. These vulnerabilities, which affect nearly every PHP installation dating back to version 5 (released in 2004), have already been patched by the PHP Foundation in the latest version, PHP 8.5.12. The NSA warned that any site unable to patch immediately should be taken offline until it can be secured.
How AI Brought These Bugs to Light
These weren’t ordinary flaws surfacing after routine code reviews—they were uncovered through advanced AI-powered security work. OpenAI, as part of its “Patch the Planet” program, collaborated with security firm Calif to discover one of the flaws using its GPT-5.6 Sol model. Meanwhile, the security company Wiz employed a combination of its Wiz Atlas agent, Google’s Gemini 4 Argon model, and GPT-5.6 Sol to unearth multiple vulnerabilities.
Both entities followed responsible disclosure practices, working alongside the PHP team to confirm the vulnerabilities and test patches before going public. Major infrastructure and content delivery players—including Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel—were also involved in reviewing and deploying fixes across the ecosystem.
Risk, Reach, and Urgency
PHP powers about 70% of all websites—more than 33 million globally—including many using platforms like WordPress. While WordPress clarified that the flaws aren’t specific to its own codebase, it urged its users and hosts to ensure PHP itself is patched. Websites on unsupported versions—PHP 8.1 and earlier—are particularly vulnerable and require immediate attention.
Although there have been no reported wild exploits of these vulnerabilities, the potential risk is staggering. The flaws allow attackers to infiltrate file systems or databases underlying PHP applications. Before AI tools, the complexity of adapting exploits across different PHP versions, configurations, and memory setups posed a barrier. AI has now lowered that barrier, enabling potential attackers to craft usable exploits faster.
With the issue now public, homes built on vulnerable PHP versions face serious danger until patched. The NSA’s guidance is stark: either update PHP to the latest version (8.5.12) or take sites offline until they can be secured.
This is a watershed moment for web security—ancient vulnerabilities hiding in plain sight, revealed by AI and demanding emergency action. Organizations should inventory their PHP versions now. Hosting providers and CMS platforms need to lead with updates. What to monitor next: the emergence of proof-of-concept exploits in the wild, how quickly large sites roll out patches, and whether this spurs a broader reexamination of legacy codebases worldwide.
