Two Critical Vulnerabilities in PHP Prompt Urgent Warning from Washington

The US National Security Agency issued a warning on Wednesday regarding two critical vulnerabilities in the PHP language used in website development, after the PHP Foundation released the necessary patches. Estimates indicate that PHP powers around 70% of websites on the internet—more than 33 million sites according to some calculations—and is used by popular content management systems such as WordPress.

The agency said the two vulnerabilities allow attackers to breach the server's file system or a database the application might use, and that any website unable to update immediately should go offline until it can do so. The vulnerabilities exist in all PHP versions since version 5, released in 2004, meaning that websites running older, unsupported versions, such as 8.1 and earlier, require an urgent update. Experts recommend upgrading to the current version 8.5.12.

The discovery of the two vulnerabilities was credited to artificial intelligence. The company "Calif", as part of OpenAI's "Patch the Planet" initiative, found one of the vulnerabilities using the GPT-5.6 Sol model, while Google's "Wiz" team used its security agent "Atlas" and models Gemini 4 Argon and GPT-5.6 Sol to find multiple vulnerabilities. Both teams followed responsible disclosure practices and worked with the PHP Foundation on patches before revealing them, with participation from companies including Automattic, Akamai, Amazon Web Services, Cloudflare, Fastly, Imperva, Microsoft, and Vercel.

OpenAI stated that researchers discovered the two vulnerabilities before hackers reached them, and there were no reports of exploitation in the wild prior to the announcement. However, Wiz warned that AI lowers the barrier to exploitation, as models can adapt attacks to different PHP versions and configurations. Following the disclosure, Cloudflare recorded exploitation attempts surging into the millions within hours, forcing millions of websites into a race against time to update their systems or temporarily shut down.

What Do These Terms Mean?

Critical Vulnerability: A security flaw that allows an attacker to execute commands or access data without permission, considered critical when its impact is widespread and easily exploitable.

Responsible Disclosure: Notifying software developers of a vulnerability before publishing its details to the public, allowing time to issue a patch and protect users.

In-the-Wild Exploitation: The actual use of a vulnerability by real attackers on users' systems, rather than merely demonstrating it in a lab or security research.