PHP flaws found by AI prompt NSA warning to patch or go offline
Two critical, decades-old PHP vulnerabilities uncovered with OpenAI and Wiz AI tools have led the NSA to urge immediate patching or taking sites offline.
The U.S. National Security Agency has issued an urgent warning about two critical vulnerabilities in PHP, the server-side language behind roughly 70% of websites. The PHP Foundation has already released patches, and the NSA's advice is blunt: any site that can't be patched right away should be taken offline until it can.
The flaws let attackers reach a server's file system or the database used by a web application. They have been present in every PHP release since version 5, which shipped in 2004. Versions 8.1 and older are no longer supported, so many sites will need a bigger upgrade. The recommended target is the current release, PHP 8.5.12.
How AI found them
As TechCrunch reports, the discoveries came from AI-assisted research. The security firm Calif, working within OpenAI's "Patch the Planet" initiative for open source software, found one flaw using GPT‑5.6 Sol. Separately, Google's Wiz used its Wiz Atlas security agent along with Gemini 4 Argon and GPT-5.6 Sol to uncover multiple vulnerabilities.
Both teams followed responsible disclosure, working with PHP on fixes before going public. Wiz also thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel for helping test the patches. WordPress, which runs on PHP, said the problem is not specific to its software, and site owners must patch their servers and coordinate with their hosting providers.
Why the risk is real
OpenAI says researchers found the bugs before attackers did, and no exploitation in the wild has been reported. Wiz cautions that these flaws were previously hard to exploit, but AI changes that: language models can help adapt an exploit to different PHP versions, configurations and memory layouts.
Now that the details are public, the race is on to update tens of millions of sites before attackers go after those left unpatched. For site owners, the practical steps are to check their PHP version, upgrade to a supported release, and ask hosting providers about their patch status.
