GoKawiilNSA warns of critical PHP flaws found using OpenAI and Google Wiz AI tools
The NSA issued an alert on two severe vulnerabilities in PHP, the server-side language that underpins roughly 70% of websites, including those running WordPress. The flaws, present since PHP version 5 in 2004, let attackers access a server's file system or database, and the PHP Foundation has already released patches, recommending an update to PHP 8.5.12. The bugs were uncovered through AI-driven security research: one by Calif using OpenAI's GPT-5.6 Sol under its 'Patch the Planet' program, and others by Google-owned Wiz using its Atlas agent alongside Gemini 4 Argon and GPT-5.6 Sol.
GoKawiil's interpretation of the reporting above, not reported fact.
The scale of PHP's footprint means unpatched sites face a broad window of exposure, which is why the NSA suggested taking vulnerable sites offline rather than risk a breach. The discovery method highlights how AI tools are increasingly being used to surface decades-old flaws in foundational software that human researchers had missed, which could reshape how open-source security auditing is conducted going forward. Coordination among major infrastructure players like Cloudflare, AWS, and Microsoft suggests the industry viewed this as a high-priority, internet-wide risk.
- NSA warned of two critical PHP vulnerabilities affecting nearly all versions since 2004.
- AI tools from OpenAI and Google's Wiz were used to discover the flaws before patches were released.
- PHP Foundation urges immediate upgrade to PHP 8.5.12 or taking unpatched sites offline.
Source: techcrunch.com — Julie Bort, 2026-10-21
Published there as: “PHP armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.