AI Uncovers Critical Decades-Old PHP Flaws, Triggering Urgent NSA Warning
Two severe PHP vulnerabilities dating back to 2004 were found using AI models from OpenAI and Wiz, prompting the NSA to urge immediate patching across millions of web servers.
Web infrastructure teams are facing urgent remediation demands after the U.S. National Security Agency issued an alert concerning two critical security vulnerabilities in PHP. The server-side scripting language underpins approximately 70 percent of web applications across the internet, accounting for more than 33 million websites, including countless deployments running the WordPress content management system. Because the newly reported flaws permit unauthorized actors to breach a server's underlying file system or associated databases, the NSA recommended that systems unable to deploy fixes immediately should be taken completely offline until updates can be applied.
Decades-Old Flaws Unearthed by AI Research
The vulnerabilities trace their origins back to PHP version 5, which made its debut in 2004. For more than two decades, the flaws remained tucked away across every subsequent release. Their eventual discovery came not from malicious threat actors, but through advanced artificial intelligence tools deployed by security researchers.
One vulnerability was detected during OpenAI's "Patch the Planet" initiative, a project dedicated to finding software defects across open-source ecosystems. Security testing firm Calif pinpointed the weakness using GPT-5.6 Sol. In parallel, researchers at Google's Wiz uncovered multiple flaws by deploying their Wiz Atlas security AI agent alongside Gemini 4 Argon and GPT-5.6 Sol.
Following responsible disclosure practices, both research teams partnered directly with the PHP Foundation to develop and validate defensive updates before publicly disclosing the issues. The remediation process broadened to draw in major internet infrastructure and cloud providers, with Wiz acknowledging contributions from Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel.
The Changing Economics of Vulnerability Exploitation
According to OpenAI, researchers discovered the flaws before threat actors could locate them, meaning there were no confirmed reports of exploits in the wild prior to the disclosure. Historically, writing functional exploits for these specific memory and configuration flaws across disparate platforms proved exceptionally difficult.
However, the rapid maturation of generative AI has reshaped that dynamic. Wiz pointed out in a technical post that modern large language models can assist attackers in adjusting exploit code to account for variations across different PHP versions, server configurations, and memory layouts. As a consequence, while frontier models have proven vital in locating legacy bugs before adversaries do, the same technology significantly lowers the technical barrier for crafting exploits once details are published. With the flaws now public, server operators are in an active race against potential attackers.
What it means for developers
For software engineers, system administrators, and site owners, the immediate priority is upgrading web server environments to PHP version 8.5.12. Deployments operating on PHP 8.1 or older versions face a particularly serious hurdle: those legacy releases are no longer officially supported, leaving no automated patch path without upgrading the runtime itself.
For teams managing WordPress setups, WordPress clarified that the flaw is not specific to its CMS codebase. Instead, the vulnerability resides within the underlying PHP environment, meaning administrators must patch their server runtimes directly or coordinate with their web-hosting providers to ensure protective measures are in place.
The incident also highlights how artificial intelligence is quickly becoming an essential component of modern security research and vulnerability discovery. Developers looking to explore the capabilities of cutting-edge frontier systems can access top AI models cheaply through one API at https://apixoai.online.
Given the explicit warning from the NSA, treating these updates as routine maintenance is insufficient. If a site cannot be migrated to PHP 8.5.12 or patched immediately, teams must consider temporarily pulling the application off the web to protect servers and connected databases from compromise.
Source: PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet — TechCrunch AI. Written by the Apixo team from that report.
One key for Claude, GPT, GLM, DeepSeek and more. Pay per token with crypto.
Get your API key
