The U.S. National Security Agency has warned of two critical vulnerabilities in PHP, the server-side programming language behind roughly 70% of websites, including those built on WordPress. The PHP Foundation has already issued patches, and the NSA advised that any site unable to update immediately should be taken offline until it can be.
The flaws, present in every PHP version since 2004, could let attackers access a server’s file system or connected databases. Sites running PHP 8.1 or older, which are no longer supported, are urged to upgrade to the current version, 8.5.12.
Both vulnerabilities were discovered using AI. Security firm Calif identified one using OpenAI’s GPT-5.6 Sol as part of OpenAI’s Patch the Planet initiative, while Google’s Wiz found multiple vulnerabilities using its Wiz Atlas security agent, Gemini 4 Argon and GPT-5.6 Sol. Both followed responsible disclosure, working with PHP and partners including AWS, Cloudflare, Microsoft and Automattic to test fixes.
OpenAI said researchers found the flaws before attackers, with no known exploits. However, Wiz cautioned that AI has removed the barrier that once made these flaws hard to exploit, as large language models can adapt attacks to different PHP versions and configurations, setting up a race to patch millions of sites.
