PHP armageddon: OpenAI and Google’s Wiz discover old flaws, panicking the Internet

The US National Security Agency issued an alarming warning on Wednesday that two critical vulnerabilities had been discovered in PHP, with fixes already released by the PHP Foundation.

PHP is a server-side programming language so widely used for web applications that it powers around 70% of websites on the Internet; by some accounts, that’s over 33 million sites. It is also used by popular content management systems like WordPress.

The NSA has warned that these flaws are so serious that if a website cannot be fixed immediately, it should be removed from the web until it can be. The vulnerabilities allow attackers to infiltrate the server’s file system or a database that can be used by the web application.

Interestingly, these flaws have been closed in all versions of PHP since version 5, released in 2004. Websites not running relatively recent versions of PHP will have some updating work to do, as PHP 8.1 and earlier are no longer supported. It is recommended to update the web server to the current version of PHP i.e. 8.5.12.

So how did two such ubiquitous, decades-old flaws that affect almost every website on the Internet suddenly come to light? AI, of course, notably via OpenAI and Google’s Wiz.

Security testing company Calif participated in OpenAI’s “Patch the Planet” initiative to detect vulnerabilities in open source software. Using GPT‑5.6 Sol, it found one of the flaws, OpenAI revealed in a blog post. Furthermore, the Wiz team also used AI, namely its security agent Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, to find several vulnerabilities in PHP.

OpenAI and Wiz followed responsible security research practices and worked with PHP on fixes before publicly disclosing the flaws. Then they all worked together to flesh out what they found and test the fixes, bringing in many other people to help.

Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel. (Although WordPress sites use PHP, WordPress released a statement saying that the flaw is not specific to WordPress and that sites running its CMS should patch their servers and work with their web hosting companies to ensure their sites are protected.)

OpenAI claims that these flaws were discovered by researchers before hackers discovered them. No exploits have therefore been reported in the wild. This is also partly because before AI, these flaws were too difficult for hackers to exploit. “With AI, this is no longer an obstacle. LLMs can help adapt an exploit to different versions, configurations and memory layouts of PHP,” Wiz warned on his blog about the flaws.

In other words, this is the kind of security problem that was discovered and avoided thanks to AI, but also poses a high risk only because of AI.

Now that the problem has been revealed, hackers are fully aware. The race is on for the Internet to fix tens of millions of websites before hackers can attack the ones that aren’t. Hence the NSA’s advice that if you can’t fix your PHP website immediately, it’s best to take it offline until you can.