NSA warns PHP operators to patch two critical vulnerabilities
The U.S. National Security Agency has warned that two critical vulnerabilities in PHP require immediate attention from website operators. The PHP Foundation has issued patches, and the NSA said sites that cannot be patched quickly should be taken offline until remediation is complete.
PHP is a server-side language used by roughly 70% of websites, or more than 33 million sites by some estimates, and underpins applications built with platforms including WordPress. The vulnerabilities can allow an attacker to access a server's file system or a database used by a web application.
Long-standing flaws now require rapid remediation
The issues have existed in PHP versions since PHP 5, released in 2004. Organisations running PHP 8.1 or older face an additional maintenance problem because those releases are no longer supported. The recommended course is to update the web server to the current PHP release, version 8.5.12.
WordPress said the vulnerabilities are not specific to its CMS. It advised operators of WordPress sites to patch their servers and work with their hosting providers to ensure their environments are protected. The required action therefore sits at the PHP runtime and hosting layer, rather than in a WordPress application update alone.
AI-assisted research found the vulnerabilities
Calif, working in OpenAI's Patch the Planet initiative, identified one flaw using GPT-5.6 Sol. Separately, Wiz used its Wiz Atlas security AI agent, Gemini 4 Argon and GPT-5.6 Sol to find multiple PHP vulnerabilities. Both groups worked with PHP maintainers on patches before public disclosure.
The validation effort also involved Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel. This coordinated process allowed researchers, maintainers and infrastructure providers to develop and test the fixes before the details became public.
OpenAI said the vulnerabilities were found by researchers before attackers discovered them, with no reports of exploitation in the wild. However, Wiz warned that large language models can help adapt an exploit across PHP versions, configurations and memory layouts. That risk is especially relevant after disclosure, when malicious actors can examine the same information.
What web teams should do now
The discovery also reflects a broader security tension: AI can accelerate the search for hard-to-find defects while lowering practical barriers to exploit development. The concern is reinforced by AI systems probing security boundaries because it illustrates how AI systems can be used to probe security boundaries and expose weaknesses.
For businesses, the immediate priority is to inventory every PHP-backed service, identify unsupported runtimes, update to PHP 8.5.12 where applicable and verify that hosting partners have completed their work. Services that cannot be patched promptly should be removed from public access until the exposure is resolved.