PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet
TechCrunch Julie Bort ● Covered by 6 sources
The NSA says two critical PHP bugs need patching now, or websites should be taken offline. They’ve sat in PHP since 2004, and AI helped find them before hackers did.
Based on reporting by TechCrunch, Julie Bort — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
The NSA issued a blunt warning on Wednesday: two critical flaws have turned up in PHP, and the fixes are already out from the PHP Foundation. PHP is everywhere on the web. It runs roughly 70% of websites, powers more than 33 million sites by some counts, and sits under tools like WordPress.
These bugs are bad enough that the NSA says unpatched sites should be pulled offline until they can be fixed. The issue is server-side access. An attacker could get into a website’s file system or a database used by the app. And the really unsettling part is how long the flaws have been waiting there: they’ve been present in every PHP version since 5, which shipped in 2004.
That means a lot of sites have updating to do. PHP 8.1 and older are no longer supported, and the advice is to move web servers to PHP 8.5.12. The timing matters because once a flaw is this widely disclosed, the race changes. Defenders know about it. So do attackers.
What pulled these bugs into the light was, predictably, AI. OpenAI says security testing firm Calif found one of them through its “Patch the Planet” effort using GPT-5.6 Sol. Wiz says its team used its Wiz Atlas security agent, Gemini 4 Argon, and GPT-5.6 Sol to find multiple PHP vulnerabilities. Both groups worked with PHP on patches before going public, then brought in others to help verify what they’d found and test the fixes.
OpenAI says the flaws were discovered before hackers found them, and there were no reports of active exploits. But Wiz also warned that AI changes the game for attackers, because models can help adapt an exploit across different PHP versions, configurations, and memory layouts. So this is one of those rare security stories that is both a win for AI and a warning about AI, all at once.
My take — AI-written commentary, not fact-checked reporting
This is the awkward modern bargain: AI helps defenders find ancient code rot, and then immediately hands attackers a sharper screwdriver. The real scandal isn’t that PHP is old; it’s that so much of the internet still runs on software nobody wants to touch until the house is already on fire.
Read more about this at: TechCrunch