NSA Warns of Severe PHP Security Flaws Uncovered by AI

The U.S. National Security Agency issued an urgent warning after two critical security flaws were discovered in the PHP programming language. The PHP Foundation has already released patches to fix the problem.

The Scope

PHP powers roughly 70 percent of all websites on the internet, which translates to more than 33 million sites. It also runs popular content management systems like WordPress. The newly exposed holes have remained hidden in every version of PHP since version 5, which came out in the year 2004.

The Risks

The NSA stated that these vulnerabilities are so severe that websites unable to apply patches immediately should be taken offline until they are secure. The flaws let attackers break into a server's file system or database linked to the web application. Websites running PHP 8.1 and older versions face extra work because those versions are no longer supported, and experts recommend updating to version 8.5.12.

The AI Factor

Artificial intelligence tools from OpenAI and Google's Wiz played a major role in uncovering the flaws. Security testing company Calif used OpenAI's GPT-5.6 Sol model through the "Patch the Planet" initiative to find one issue, while the Wiz team used its Wiz Atlas security agent alongside Gemini 4 Argon and GPT-5.6 Sol to discover multiple vulnerabilities. Researchers found the flaws before hackers did, meaning there were no initial reports of active exploits. However, AI also increases the risk because large language models can help attackers adapt exploits to different versions and memory layouts that were previously too difficult to target.

Context

Software vulnerabilities are common in widely used programming languages, but discovering decades-old bugs highlights how advanced tools can scan massive codebases quickly. Cybersecurity agencies frequently issue offline recommendations when critical server-side flaws emerge to prevent widespread data breaches.