AI unveils critical PHP vulnerabilities, spurring global patching urgency

The U.S. National Security Agency (NSA) issued a warning that two severe vulnerabilities in PHP, a server-side language used by 70% of websites, have been discovered. The flaws, present in all PHP versions since 2004, allow attackers to infiltrate servers or databases. The NSA urged immediate patching or offline status for unpatched sites. OpenAI and Google’s Wiz, using AI tools like GPT-5.6 Sol and Gemini 4 Argon, identified the vulnerabilities. Both companies followed responsible disclosure practices, collaborating with PHP developers to release patches. Wiz highlighted that AI now enables exploit adaptation across different PHP versions, making these flaws a significant risk. With the vulnerabilities now public, hackers are likely to target unpatched sites, prompting a global effort to update millions of websites. WordPress, while not directly affected, advised users to patch their servers.