PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet

The U.S. National Security Agency issued an urgent warning on Wednesday about two critical vulnerabilities in PHP, the server-side language powering roughly 70% of websites—over 33 million sites—and used by systems like WordPress. The NSA advised that any site that cannot be patched immediately should be taken offline until it can be, since the flaws allow attackers to infiltrate the server's file system or databases. The holes have existed in every PHP version since 5, released in 2004, and sites running unsupported versions such as PHP 8.1 and older must upgrade, ideally to the current PHP 8.5.12. The flaws were found using AI: security firm Calif, working under OpenAI's 'Patch the Planet' initiative, discovered one using GPT-5.6 Sol, while Wiz's Atlas security AI agent used Gemini 4 Argon and GPT-5.6 Sol to find multiple PHP vulnerabilities. Both teams followed responsible disclosure practices, collaborating with PHP and others including Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel to test patches. OpenAI says researchers found the flaws before hackers and there are no reports of exploits in the wild, partly because these flaws were too hard to exploit before AI; Wiz warns LLMs can now adapt exploits to different PHP versions, configurations, and memory layouts. With the issue now public, the race is on to patch tens of millions of websites before hackers attack unpatched ones, prompting the NSA's advice to pull sites offline if they can't be patched immediately.

(Source：TechCrunch)