The U.S. National Security Agency has issued a warning regarding two critical vulnerabilities discovered in the PHP programming language. These flaws affect all versions of PHP released since 2004, including version 5. PHP currently powers approximately 70% of websites on the internet, totaling over 33 million sites.
The vulnerabilities allow attackers to gain unauthorized access to server file systems or databases. The PHP Foundation has already released patches for the security holes. Experts recommend updating web servers to the current version, 8.5.12, as versions 8.1 and older are no longer supported.
The flaws were identified using AI tools, including OpenAI’s GPT-5.6 Sol and the Wiz Atlas security agent powered by Gemini 4 Argon. OpenAI and Wiz collaborated with the PHP Foundation to develop and test the patches before public disclosure. Major infrastructure providers, including AWS, Cloudflare, and Microsoft, participated in the process.
While there are no reports of these vulnerabilities being exploited by hackers, the NSA advises that websites unable to apply patches immediately should be taken offline. The use of LLMs now allows attackers to adapt exploits to various configurations, significantly lowering the barrier for potential cyberattacks.
