Brief
NSA warns of critical PHP flaws uncovered by OpenAI and Google’s Wiz
Two decades‑old PHP bugs discovered by AI firms prompted an NSA advisory urging rapid updates.
By Felo News Desk · Published
The U.S. National Security Agency issued an urgent warning on Wednesday about two critical vulnerabilities in the PHP programming language, saying sites that cannot patch immediately should be taken offline. PHP powers roughly 70% of web sites, including many WordPress installations, and the flaws affect all versions dating back to PHP 5 released in 2004.
Security testing firm Calif, working under OpenAI’s “Patch the Planet” program, used GPT‑5.6 Sol to locate one of the bugs, which OpenAI disclosed in a blog post. Google’s Wiz team employed its Wiz Atlas security AI, Gemini 4 Argon, and GPT‑5.6 Sol to uncover additional issues. Both firms followed responsible disclosure practices, collaborating with the PHP Foundation to develop patches before public release.
The NSA’s advisory notes that the vulnerabilities allow attackers to infiltrate a server’s file system or database. It recommends updating to the current PHP version 8.5.12 and, if that is not possible, removing the site from the internet until a fix can be applied. The agency warned that unpatched sites remain at high risk now that the flaws are public.
Wiz thanked major cloud and security providers—including Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel—for assisting in testing the patches. WordPress issued a statement clarifying that the bugs are not specific to its platform but that WordPress sites must ensure their underlying PHP servers are updated.
OpenAI said the flaws were discovered by researchers before any exploitation in the wild, attributing the lack of attacks to the difficulty of exploiting the bugs without AI assistance. Wiz warned that large‑language models now remove that barrier, making the vulnerabilities especially dangerous.
Key facts
- The NSA warned that two critical PHP vulnerabilities require immediate patching or site removal. (techcrunch.com)
- The flaws affect all PHP versions from 5 (2004) onward and were found using AI tools from OpenAI and Google’s Wiz. (techcrunch.com)
- Patches have been released by the PHP Foundation; the recommended version is PHP 8.5.12. (techcrunch.com)
- Wiz thanked cloud and security firms such as Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel for helping test the patches. (techcrunch.com)
- WordPress said the bugs are not WordPress‑specific but urged site owners to update their PHP servers. (techcrunch.com)
Sources
- [1] techcrunch.com — originally reported as “PHP armageddon: OpenAI, Google's Wiz find ancient holes, panicking the internet”
