NSA Warns As AI Uncovers Decades-Old Flaws In PHP

The NSA issued an alert after OpenAI and Google's Wiz discovered severe, long-standing security holes in PHP, urging administrators to update or take sites offline.

NationPulse Desk

Oct 21, 2026 · 10:59 PM 2 min read 288

Key takeaways

The U.S. National Security Agency issued a warning on Wednesday about two critical holes found in PHP.

PHP powers roughly 70% of websites on the internet, which is more than 33 million sites.

OpenAI and Google's Wiz discovered the flaws using artificial intelligence tools.

The PHP Foundation has already issued patches for the vulnerabilities.

The NSA advised that unpatched websites should be pulled off the web until they are fixed.

On Wednesday, the U.S. National Security Agency issued an urgent warning about two major security flaws discovered in PHP, prompting the PHP Foundation to release patches.

Roughly 70% of websites on the internet rely on the server-side programming language PHP for web applications, translating to more than 33 million sites, and the language also powers content management systems such as WordPress.

According to the NSA, the vulnerabilities are severe enough that administrators unable to patch their websites immediately should take them offline until the fix is applied, since the holes permit attackers to access server file systems or connected databases.

These vulnerabilities have existed in every version of PHP since version 5 debuted in 2004, meaning sites running unsupported versions like PHP 8.1 and older face extensive updates, with current recommendations pointing to version 8.5.12.

Artificial intelligence tools from OpenAI and Google's Wiz brought these two decades-old, widespread flaws to light.

OpenAI shared in a blog post that security testing firm Calif uncovered one vulnerability using GPT-5.6 Sol as part of the Patch the Planet initiative, while the Wiz team independently used its Wiz Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol to detect multiple PHP vulnerabilities.

OpenAI and Wiz adhered to responsible security disclosure by coordinating with PHP on patches prior to public release, and they collaborated with various organizations to test the fixes.

Wiz expressed gratitude to Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel, while WordPress clarified in a statement that the flaw is not specific to its platform and urged users to patch their servers through their web-hosting providers.

Researchers identified the flaws before hackers did, according to OpenAI, meaning there were no reports of active exploits because hackers previously found the vulnerabilities too complex to exploit.

Wiz stated in a blog post that artificial intelligence removes that barrier because large language models can adapt exploits to various PHP versions, configurations, and memory layouts.

This security issue was caught and prevented thanks to artificial intelligence, yet it presents a high risk specifically because of artificial intelligence.

With public disclosure now complete, hackers are fully aware of the issue, creating a race to patch tens of millions of websites before attacks occur, which prompted the NSA advice to take unpatched PHP sites offline immediately.

Questions and answers

What did the NSA advise website owners to do?

The NSA warned that if a website cannot be patched immediately, it should be pulled off the web until it can be.

How were the flaws discovered?

OpenAI and Google's Wiz discovered the vulnerabilities using artificial intelligence tools such as GPT-5.6 Sol, Gemini 4 Argon, and the Wiz Atlas security AI agent.