AI Tools Uncover Two-Decade-Old PHP Flaws as NSA Urges Urgent Patching

The U.S. National Security Agency has warned about two serious security flaws in PHP, a programming language used to run websites on servers. PHP powers about 70% of websites, including sites built with WordPress. The PHP Foundation has already released fixes. The NSA advised that any website that cannot be updated right away should be taken offline until it can be updated.

These flaws have existed in every PHP version released since 2004. They could allow attackers to access files on a server or reach databases connected to it. Websites using PHP 8.1 or older are especially at risk because these versions are no longer supported. Their owners are urged to upgrade to the current version, 8.5.12.

AI tools helped discover both security flaws. Security firm Calif found one using OpenAI's GPT-5.6 Sol as part of OpenAI's Patch the Planet project. Google's Wiz found several flaws using its Wiz Atlas security agent, Gemini 4 Argon and GPT-5.6 Sol. Both companies reported the flaws responsibly and worked with PHP and partners, including AWS, Cloudflare, Microsoft and Automattic, to test fixes.

OpenAI said researchers found the flaws before attackers did, and there are no known cases of them being used in attacks. However, Wiz warned that AI has made these flaws much easier to exploit. Large language models can adjust attacks to work with different PHP versions and settings. This has created a race to fix the flaws across millions of websites before attackers can take advantage of them.