PHP Flaws Found With AI Help Put Websites at Risk, NSA Warns
Patches are out for two decades-old PHP holes that OpenAI and Google's Wiz say AI tools found before hackers could exploit them
By AXY AI Desk ·
Key points
- The NSA warned that two critical PHP flaws can let attackers reach a server's file system or databases, and said unpatched sites should be taken offline.
- PHP powers roughly 70% of websites, and the flaws have existed in every version since PHP 5, released in 2004.
- OpenAI and Google's Wiz say AI tools helped find the flaws, and say there were no reports of exploits in the wild.
- The recommended fix is to update to PHP 8.5.12, since PHP 8.1 and older versions are no longer supported.
The U.S. National Security Agency has warned that two serious security holes in PHP, a programming language that runs much of the web, need to be fixed right away. The agency said on Wednesday that the holes are critical and that the PHP Foundation has already issued patches. Website operators who cannot update immediately should take their sites offline until they can. The flaws were uncovered with help from artificial intelligence tools, which has turned a routine security notice into a wider debate about who finds these bugs first.
Why PHP Sits Under So Much of the Web
PHP is a server-side programming language, which means it runs on the web server rather than inside a visitor's browser. It builds pages, handles logins, processes forms and talks to databases. According to the source material, it powers roughly 70% of websites on the internet, and by some accounts that is more than 33 million sites. It is also used by popular content management systems such as WordPress, the software behind many blogs and business websites.
That reach is the reason this warning matters beyond the technical teams that run PHP. A flaw in a tool this common is not one bad website waiting to be found. It is a possible shared door into a large share of the web, including sites belonging to small businesses, schools and community groups that may have no dedicated security staff.
What the Two Holes Let Attackers Do
The NSA said the holes are severe enough that any site that cannot be patched immediately should be pulled off the web until it can be. According to the source, the flaws allow attackers to get into a server's file system or into a database that the web application may use.
For a site owner, those two targets are the core of the business. The file system holds the code and files that make a site work. A database typically holds things like customer accounts, orders and published content. Access to either one can mean stolen information, altered pages or a server that an attacker can control, which is why the agency's advice was blunt.
Decades-Old Code and the Versions at Risk
The holes have been present in all versions of PHP since version 5, which was released in 2004. That means the weakness has sat inside the language for more than two decades, long before modern AI tools existed to search for it. Nobody has to have written new code to be affected. Any site running an older version of PHP may be exposed.
The update path is not automatic for everyone. PHP 8.1 and older versions are no longer supported, so sites still running them will have upgrading work to do. The recommendation is to move the web server to the current version, PHP 8.5.12. For a small site, that may be a simple setting change with the host. For an older site with custom code or old plugins, the upgrade could require testing before it goes live, which is one reason why the NSA's advice to take unpatched sites offline is so direct.
How OpenAI and Google's Wiz Found the Flaws
The discovery did not come from a single lab. Security testing company Calif was taking part in OpenAI's "Patch the Planet" initiative, which looks for flaws in open source software. Using GPT-5.6 Sol, Calif found one of the flaws, OpenAI said in a blog post.
Separately, the Wiz team used its Wiz Atlas security AI agent, Gemini 4 Argon and GPT-5.6 Sol to find multiple vulnerabilities in PHP. The source says both OpenAI and Wiz followed responsible security research practices. They worked with PHP on patches before any flaws were publicly disclosed, then worked together to understand what had been found and to test the fixes, drawing in other companies to help.
Who Helped Test the Fixes
Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel for their help. Those names cover hosting, content delivery and cloud infrastructure, the layers many websites rely on to stay online. Testing fixes across that kind of infrastructure is slow work, and it is one reason a patch can exist long before most sites have installed it.
WordPress has issued a statement saying the flaw is not specific to WordPress. Even so, the source notes that WordPress sites use PHP, so anyone running its software must patch their servers and work with their web hosting companies to make sure their sites are protected. The fix sits with the server, not only with the blogging software on top of it.
Why Hackers Had Not Used the Flaws Yet
OpenAI says the flaws were found by researchers before hackers discovered them, so there were no reports of exploits in the wild. That phrase means attacks that have actually been seen on real websites. In this case, the source says, none have been reported.
Wiz offered a reason the flaws had stayed out of reach. Before AI, the source says, these flaws were too hard for hackers to exploit. Wiz was blunt about what has changed. "With AI this is no longer a barrier. LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts," Wiz warned in its blog about the flaws. LLMs, or large language models, are the type of AI system behind many chatbots, and in this context they can help an attacker tailor an attack to the many different ways PHP is set up.
The Double-Edged Problem for Security Teams
The source puts the situation in a sharp way: this is a security issue that was found and prevented because of AI, but it is also a high risk only because of AI. Both things are true at once. The same kind of tool that helped defenders locate the holes could help attackers adapt known weaknesses more quickly.
In AXY's view, the most important question is the time between disclosure and patching. Once a flaw is public, the window in which a site owner can update before an attacker acts becomes the critical period. This could mean that sites that update quickly are well protected, while sites that delay face a much higher risk. The next test is how many websites move to PHP 8.5.12 quickly, and how many remain on older versions.
What Site Owners Should Do Now
The immediate steps follow directly from the NSA's warning. Site owners should first find out which version of PHP their web server runs. If it is older than the current release, the recommendation is to update to PHP 8.5.12. If a site cannot be patched right away, the NSA says it should be taken offline until it can be.
Website owners who use WordPress should also contact their web host, because the source says patching the server and working with the hosting company is what protects these sites. Anyone with custom code should test the upgrade before going live, since older code may behave differently on a newer version. For readers who are not site owners, the practical point is simpler: if a service you use runs on a website that goes offline for an update, that interruption is the price of closing a hole that could otherwise expose your data.
Questions and answers
What did the NSA warn about PHP?
The NSA warned on Wednesday that two critical holes had been found in PHP, with patches already issued by the PHP Foundation. The agency said sites that cannot be patched immediately should be pulled off the web until they can.
Which websites are affected by the PHP flaws?
PHP powers roughly 70% of websites on the internet, and it is used by content management systems such as WordPress. The flaws have been present in all versions of PHP since version 5, released in 2004.
Were the PHP flaws found by AI?
OpenAI and Google's Wiz say AI tools helped find the flaws. Calif, working in OpenAI's Patch the Planet initiative, found one flaw using GPT-5.6 Sol, and the Wiz team used several AI tools to find multiple vulnerabilities in PHP.
Topics: PHP, NSA, OpenAI, Wiz, WordPress, web security, AI vulnerability research
Sources: TechCrunch AI
https://axynewsglobal.com/article/php-flaws-found-with-ai-help-put-websites-at-risk-nsa-warns