AI Uncovers Critical Decades-Old PHP Vulnerabilities, Prompting Urgent Global Web Security Response

Image: TechCrunch · Source

OpenAI and Google's AI-driven tools have identified severe PHP security flaws present since 2004, leading to a coordinated response involving major tech companies and urgent patching guidance from the NSA to protect millions of websites.

On October 21, 2026, the United States National Security Agency (NSA) issued a dire warning concerning two critical security vulnerabilities discovered in PHP, a predominant server-side programming language that underpins about 70% of the world’s websites—including many running popular content management systems like WordPress. The vulnerabilities, which enable attackers to access the file system or databases of affected web servers, trace back to PHP version 5 released in 2004, meaning countless sites have been potentially exposed for nearly two decades.

The PHP Foundation has already issued patches addressing these flaws, with a strong recommendation from the NSA that any website unable to apply these updates immediately should be taken offline to prevent exploitation. Notably, versions older than PHP 8.1 are no longer supported, making an upgrade to PHP 8.5.12 or later essential for security.

Crucially, these long-standing vulnerabilities came to light thanks to advances in artificial intelligence. OpenAI’s initiative "Patch the Planet," leveraging their GPT-5.6 Sol model, discovered one such flaw. Simultaneously, security firm Wiz utilized its AI-driven tools, including the Wiz Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol, to identify multiple additional vulnerabilities within PHP.

Both OpenAI and Wiz adhered to responsible disclosure protocols, collaborating closely with the PHP Foundation to develop and validate patches before public announcement. The effort expanded into a broad coalition involving technology leaders such as Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel, ensuring rapid evaluation and dissemination of fixes. Although WordPress sites employ PHP, WordPress itself clarified that the vulnerabilities are not specific to its content management system, urging users to work with hosting providers to secure their installations.

OpenAI emphasized that these defects were uncovered by researchers prior to any known hacker exploitation, a window of opportunity likely afforded by the previous difficulties in identifying and exploiting such deep-rooted issues. However, Wiz cautioned that the advent of large language models now lowers barriers for attackers to adapt exploits across PHP versions and configurations, effectively elevating the risk profile.

Thus, this event exemplifies a paradox of AI’s role in cybersecurity: it has been instrumental in detecting and preempting high-risk vulnerabilities but simultaneously reduces the time frame between vulnerability disclosure and exploitation by malicious actors. The ongoing challenge for the global internet ecosystem is expeditiously patching tens of millions of PHP-powered websites to thwart potential attacks. The NSA’s insistence on immediate action or temporary site removal underscores the urgency of this critical security incident.