- The US National Security Agency warned on October 21, 2026 that two critical flaws affecting every PHP version since 5 (released in 2004) let attackers infiltrate a server’s file system or database.
- The PHP Foundation has already issued patches; the NSA says sites that cannot patch immediately should be taken offline, with PHP 8.1 and older no longer supported.
- OpenAI‘s GPT-5.6 Sol found one flaw through its “Patch the Planet” initiative with security firm Calif, while Google’s Wiz team used its Wiz Atlas agent alongside Gemini 4 Argon and GPT-5.6 Sol to find multiple others.
- PHP powers an estimated 70% of websites, more than 33 million sites, including those built on WordPress, which said the flaw is not WordPress-specific but still requires server-level patching.
What Happened
The NSA issued an alarming warning about two critical, decades-old PHP vulnerabilities after OpenAI and Google’s Wiz team separately discovered them using AI security tools, TechCrunch reported on October 21, 2026. Both companies disclosed responsibly, coordinating with the PHP Foundation on patches before going public.
Why It Matters
Wiz, which Google agreed to acquire in a security-software market that has drawn other large deals, including Salesforce’s $18 billion purchase of cloud security firm Wiz, demonstrates how AI-driven vulnerability research is now surfacing flaws that were previously too labor-intensive for attackers or defenders to find at scale.
Technical Details
The recommended fix is upgrading to PHP 8.5.12, the current version. Wiz credited Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel for helping test patches, and OpenAI said the flaws were found before any known exploitation in the wild.
Who’s Affected
Any organization running PHP-based web applications, including WordPress sites, must verify and apply the patch; the NSA says the flaws allow attackers to reach a server’s file system or backing database if left unpatched.
What’s Next
OpenAI and Wiz say the same AI tools that found these bugs lower the barrier for attackers to find similar ones going forward, meaning server operators should expect continued disclosures of long-standing flaws in widely used, older software.
