The National Security Agency of the United States issued a warning on Wednesday stating that two serious vulnerabilities were found in PHP, and a patch has already been released for PHP Foundation.

PHP is a server-side programming language that is widely used in web applications and supports approximately 70% of websites on the Internet; according to some statistics, this number exceeds 33 million websites. It is also used by popular content management systems such as WordPress.

NSA warns that these vulnerabilities are so severe that if websites cannot be patched immediately, they should be taken offline from the internet until the repairs are completed. The vulnerabilities could allow attackers to penetrate into the server file system or gain access to databases that may be used by web applications.

Interestingly, these vulnerabilities have been lurking in all versions since PHP 5, while PHP 5 was released in 2004. Websites that are not running the relatively newer version PHP will need to be updated, as PHP 8.1 and earlier versions are no longer supported. It is recommended to update Web servers to the current version PHP 8.5.12.

So, why have these vulnerabilities, which have affected almost the entire internet and have existed for decades, suddenly come to light? The answer lies in artificial intelligence, particularly OpenAI and Wiz under Google.

Security testing company Calif was invited to participate in OpenAI's “Patch the Planet” program, aimed at identifying vulnerabilities in open-source software. In a blog post, OpenAI stated that they used GPT-5.6 Sol to find one of these vulnerabilities. On the other hand, the Wiz team also utilized AI, including their Wiz Atlas security AI proxy, Gemini 4, Argon, and GPT-5.6 Sol, to discover multiple vulnerabilities within PHP.

OpenAI and Wiz both adhere to responsible security research practices and collaborate with PHP to fix vulnerabilities before publicly disclosing them. Subsequently, all parties worked together to review the findings and test the patches, and also sought assistance from multiple parties.

Wiz would like to thank Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel. (Although the WordPress website uses PHP, WordPress has stated that this vulnerability is not unique to WordPress; websites running their CMS must patch their servers and cooperate with their web hosting companies to ensure that the sites are protected.)

OpenAI indicates that these vulnerabilities were discovered by researchers before they were found by hackers, therefore there are no reports of these vulnerabilities being exploited in the wild. This is also partly because, before AI appeared, these vulnerabilities were too difficult to exploit for hackers. A blog introducing these vulnerabilities warned: "With AI, this is no longer an obstacle. LLM can help to adjust the exploitation methods for different PHP versions, configurations, and memory layouts."

In other words, the discovery and avoidance of such security issues are partly due to AI; however, the reason why it is so highly risky is also because of AI.

Now that the issue has been exposed and hackers are fully aware of it, the internet is racing against time to fix tens of millions of websites before they are attacked by hackers. Therefore, NSA suggests that if you are unable to fix your PHP website immediately, it is best to take it offline until the repairs are completed.