NSA Warns of Two Critical PHP Flaws Found by OpenAI and Google's Wiz Using AI
On Wednesday, the U.S. National Security Agency issued a critical alert regarding two significant vulnerabilities in PHP, impacting approximately 70% of all websites, which equates to over 33 million sites. The PHP Foundation has released patches to address these issues. The NSA recommended that any site unable to implement the patches immediately should be taken offline. These vulnerabilities affect every PHP version since 5, allowing potential server breaches. Sites running PHP 8.1 or earlier need to upgrade, with the latest version being 8.5.12. The flaws were identified by Calif using GPT-5.6 Sol and by Google's Wiz team with its security AI. Both entities collaborated with PHP on the patches. WordPress clarified that the vulnerabilities are not exclusive to its CMS. No known exploits have been detected in the wild.
Key facts
- The NSA issued a warning on Wednesday about two critical PHP vulnerabilities, with patches from the PHP Foundation
- PHP powers roughly 70% of websites, by some accounts more than 33 million sites
- The flaws have existed in all PHP versions since version 5, released in 2004
- PHP 8.1 and older are unsupported; the current version is 8.5.12
- Calif found one flaw under OpenAI's "Patch the Planet" initiative using GPT-5.6 Sol
- Wiz used its Wiz Atlas agent, Gemini 4 Argon and GPT-5.6 Sol to find multiple vulnerabilities
- Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel
- OpenAI reported no exploits in the wild before disclosure
Entities
Institutions
- U.S. National Security Agency
- PHP Foundation
- OpenAI
- Wiz
- Calif
- Automattic
- Akamai
- AWS
- Cloudflare
- Fastly
- Imperva
- Microsoft
- Vercel
- WordPress
- TechCrunch
- US National Security Agency
Locations
- United States