NSA warns of critical PHP holes

The U.S. National Security Agency warned on Wednesday that two critical vulnerabilities were found in PHP, a server-side programming language powering roughly seventy percent of websites on the internet.

The scale of the problem

PHP powers more than thirty three million sites and is used by popular content management systems like WordPress. The holes allow attackers to infiltrate server file systems or databases used by web applications.

Holes hidden for twenty two years

These vulnerabilities have existed in all versions of PHP since version five, released in two thousand four.PHP eight point one and older versions are no longer supported.

AI discovered the ancient flaws

Security testing company Calif, engaged in OpenAI's Patch the Planet initiative, found one flaw using GPT five point six Sol.

Responsible disclosure before public release

Both OpenAI and Wiz followed responsible security research practices, working with PHP on patches before publicly disclosing the flaws. They worked together to test patches with Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel.

AI made old exploits dangerous

OpenAI says researchers found these flaws before hackers did, with no reports of exploits in the wild.Before AI, these flaws were too hard for hackers to exploit.

“LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts.”

Race to patch before attacks begin

Now that the issue is disclosed, hackers know about it.The NSA guidance is clear: if you cannot patch your PHP website immediately, pull it offline until you can.