The U.S. National Security Agency (NSA) warned on Wednesday that two critical vulnerabilities were found in PHP and that the PHP Foundation has already released patches. The NSA advised that websites that cannot be patched immediately should be taken offline until they can be updated.
Scope and risk
PHP is a server-side programming language used by roughly 70% of websites — by some estimates more than 33 million sites. It also underpins many popular content management systems, including WordPress, so vulnerabilities in PHP can have very broad impact.
According to the advisory, the identified flaws could allow attackers to access a server’s filesystem or application-used databases. The vulnerabilities have been present in PHP releases going back to PHP 5, which was released in 2004. The PHP Foundation recommends upgrading to a supported current release; the current stable version is PHP 8.5.12, while PHP 8.1 and older versions no longer receive support.
How the flaws were found
Artificial intelligence tools played the central role in uncovering these long-standing vulnerabilities. Researchers associated with OpenAI and the security company Wiz used AI to detect the flaws.
Security testing firm Calif participated in OpenAI’s “Patch the Planet” initiative and discovered one of the flaws using GPT‑5.6 Sol, OpenAI disclosed in a blog post. Separately, Wiz’s team used its Wiz Atlas security agent together with Gemini 4 Argon and GPT‑5.6 Sol to identify multiple vulnerabilities in PHP.
Both OpenAI and Wiz followed responsible disclosure practices: they worked with the PHP project on developing patches before publicly disclosing the vulnerabilities, and then collaborated to validate the fixes and test them with a broader group of partners.
Coordination and participants
Wiz expressed thanks to a number of companies that helped test and validate fixes, including Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel. WordPress has issued a statement noting that the flaw is not specific to WordPress itself; site operators running WordPress must ensure their servers are patched and coordinate with hosting providers.
No known in-the-wild exploits yet — but AI changes the equation
OpenAI says the vulnerabilities were discovered by researchers before malicious actors found them, and there have been no reports of in-the-wild exploitation to date. However, security teams warn that AI lowers the technical barrier for attackers: large language models (LLMs) can assist in adapting an exploit across different PHP versions, configurations, and memory layouts, making previously hard-to-exploit bugs more accessible.
In short, AI was instrumental both in finding and preventing these issues and in increasing the potential risk by making exploitation easier for adversaries.
Recommended actions for site operators
Site operators should apply the patches released by the PHP Foundation or upgrade to the supported PHP 8.5.12 release. If an immediate update is not possible, the NSA recommends taking the affected site offline until it can be secured.
The disclosure sets off a race to patch millions of websites before attackers can target unpatched systems. The coordinated response by AI researchers, security firms and infrastructure providers helped identify and remediate the vulnerabilities before public exploitation was observed, but rapid action by site operators and hosting providers remains crucial.
