AI News · The messy stuff ·
NSA warns of two critical PHP flaws found with help from OpenAI and Wiz AI tools
The US National Security Agency warned on Wednesday of two critical vulnerabilities in PHP, the language TechCrunch says powers roughly 70% of websites. The PHP Foundation has issued patches, and the flaws were found by security firms Calif and Wiz using AI models including OpenAI's GPT-5.6 Sol.
Key points
- The NSA advises taking unpatched PHP sites offline until they can be updated.
- The flaws affect all PHP versions since version 5; the recommended update is PHP 8.5.12.
- Calif and Wiz found the flaws using AI models including GPT-5.6 Sol and Gemini 4 Argon.
What happened: The US National Security Agency warned on Wednesday that two critical vulnerabilities had been found in PHP, TechCrunch reported. The PHP Foundation has issued patches. The NSA said the flaws are severe enough that any site that cannot be patched immediately should be taken offline until it can be.
The details: The flaws allow attackers to access a server's file system or a database used by the web app. According to TechCrunch, they have existed in all PHP versions since version 5, released in 2004. The recommended update is PHP 8.5.12, and PHP 8.1 and older are no longer supported. Security testing firm Calif, working in OpenAI's Patch the Planet initiative, found one flaw using GPT-5.6 Sol. Separately, Wiz used its Wiz Atlas security agent, Gemini 4 Argon and GPT-5.6 Sol to find multiple PHP vulnerabilities. CVE identifiers and severity scores were not reported.
Who it affects: WordPress said the flaw is not specific to WordPress, but sites running it must patch their servers and work with their hosting providers. Both OpenAI and Wiz followed responsible disclosure and tested the patches with partners including Akamai, AWS, Cloudflare, Microsoft and Vercel, Wiz said.
What to watch: OpenAI says there are no reports of exploitation in the wild. Wiz warned that large language models can help attackers adapt an exploit to different PHP versions and configurations, which leaves unpatched sites exposed now that the flaws are public.
Our take
AI security agents are now finding serious flaws in core web software, so teams need fast patching routines for anything that runs PHP.