The U.S. National Security Agency (NSA) issued a serious warning on Wednesday regarding two critical vulnerabilities found in PHP, a server-side programming language that powers approximately 70% of websites on the internet, equating to over 33 million sites. The PHP Foundation has already released patches for these vulnerabilities, which are severe enough that the NSA advises any website unable to apply the patches immediately should be taken offline until it can be secured.

Details of the Vulnerabilities

These vulnerabilities allow attackers to access the server's file system or databases used by web applications. Notably, these flaws have existed in all versions of PHP since version 5, which was released in 2004. Websites running older, unsupported versions of PHP, particularly those prior to PHP 8.1, will need to update to the current version, 8.5.12.

Discovery Through AI

The discovery of these long-standing vulnerabilities was made possible through AI technologies, specifically by OpenAI and Google's Wiz. The security testing company Calif participated in OpenAI's "Patch the Planet" initiative, utilizing GPT-5.6 Sol to identify one of the flaws. Meanwhile, the Wiz team employed its Wiz Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol to uncover multiple vulnerabilities in PHP.