The U.S. National Security Agency (NSA) warned on Wednesday that two critical PHP vulnerabilities put a large share of the web at risk. Its advice is blunt: sites that cannot patch right away should go offline until they can. The PHP Foundation has already released fixes.
PHP is the server-side language behind roughly 70% of websites, which by some counts means more than 33 million sites. It also runs content management systems such as WordPress. According to the NSA, the flaws let attackers reach a server’s file system or the database a web app relies on.
PHP vulnerabilities trace back to 2004
Both holes have existed in every PHP release since version 5, which shipped in 2004. That leaves real upgrade work for anyone running older servers. PHP 8.1 and earlier no longer receive support, so the guidance is to move to the current release, PHP 8.5.12.
How AI tools found the flaws
The discovery came out of AI-assisted security research. Testing firm Calif found one of the bugs while working on OpenAI‘s “Patch the Planet” initiative, which hunts for flaws in open source software. Calif used GPT-5.6 Sol to do it, OpenAI said in a blog post.
Meanwhile, Wiz, the security company owned by Google, ran its own search. Its team paired the Wiz Atlas security agent with Gemini 4 Argon and GPT-5.6 Sol, and turned up several more bugs in PHP.
Both groups followed responsible disclosure. They worked with the PHP project on patches before going public, then brought in other companies to examine the findings and test the fixes. Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel for their help.
What WordPress site owners need to do
WordPress has said the issue is not specific to its software. Still, every WordPress site runs on PHP, so owners need to update their servers and confirm with their hosting company that the fix for the PHP vulnerabilities is in place.
The same goes for gaming news sites, community forums and fan wikis built on WordPress or other PHP software. If the host handles server updates, the job is to check that it has done so. If the site runs on a self-managed server, the upgrade falls to the owner.
Why AI makes the PHP vulnerabilities urgent
OpenAI says researchers found the flaws before attackers did, and there are no reports of exploitation in the wild so far. Part of the reason is that the bugs were too hard to exploit before AI tools arrived.
Wiz warned that this protection no longer holds. “With AI this is no longer a barrier. LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts,” the company wrote in its blog post about the flaws.
In other words, AI surfaced the PHP vulnerabilities, and AI is also what makes them dangerous now. With the details public, attackers know where to look. Tens of millions of websites need the update before anyone turns the bugs into working attacks, which is why the NSA says to patch now or pull the site offline until the fix is installed.