NSA alerts to critical PHP vulnerabilities discovered with AI assistance
The U.S. National Security Agency warned of two severe PHP flaws dating back to 2004, for which patches have been released, and highlighted the role of AI tools in uncovering them.
The U.S. National Security Agency issued a warning on Wednesday about two critical vulnerabilities in the PHP programming language, which powers roughly 70% of websites. The agency advised that sites unable to apply the patches immediately should be taken offline until they can be updated.
The flaws, present in all PHP versions since 2004, allow attackers to access a server’s file system or database. The PHP Foundation has released patches, and the recommended upgrade is to the latest PHP version, 8.5.12, as earlier releases are no longer supported.
Researchers from security firm Calif, participating in OpenAI’s “Patch the Planet” initiative, used the GPT-5.6 Sol model to identify one of the vulnerabilities, which OpenAI disclosed in a blog post. Separately, Google’s Wiz team employed its Wiz Atlas security AI agent, Gemini 4 Argon, alongside GPT-5.6 Sol, to uncover additional issues.
Both OpenAI and Wiz followed responsible disclosure procedures, collaborating with the PHP project to develop and test the patches before public release. Wiz thanked several industry partners, including Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel, for their assistance.
"With AI this is no longer a barrier. LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts," Wiz warned in its blog.
WordPress, which relies on PHP, issued a statement that the flaw is not specific to its platform but urged site operators to patch their servers and coordinate with hosting providers. No evidence of exploitation in the wild has been reported, but the NSA emphasized the urgency of remediation to prevent potential attacks.