# Ancient PHP flaws found by AI, threatening millions of websites

> OpenAI and Wiz discovered critical vulnerabilities in PHP using AI tools. The holes have existed since 2004 and affect roughly 70% of the internet.
- Title: Ancient PHP flaws found by AI, threatening millions of…
- Summary: OpenAI and Wiz discovered critical vulnerabilities in PHP using AI tools. The holes have existed since 2004 and affect roughly 70% of the internet. The NSA…
- Keywords: php, cybersecurity, openai, wiz, nsa, ai security, vulnerabilities, wordpress, technology, startups, Ancient, flaws
- Source: TechCrunch — https://techcrunch.com/2026/10/21/php-armageddon-openai-googles-wiz-find-ancient-holes-panicking-the-internet
- Author: Julie Bort
- Published: 2026-10-21T17:59:12+00:00
- Read time: 1 min
- Topics: php, cybersecurity, openai, wiz, nsa, ai security, vulnerabilities, wordpress, technology, startups
## NSA warns of critical PHP holes
The U.S. National Security Agency warned on Wednesday that two critical vulnerabilities were found in PHP, a server-side programming language powering roughly seventy percent of websites on the internet.
## The scale of the problem
PHP powers more than thirty three million sites and is used by popular content management systems like WordPress. The holes allow attackers to infiltrate server file systems or databases used by web applications.
## Holes hidden for twenty two years
These vulnerabilities have existed in all versions of PHP since version five, released in two thousand four.PHP eight point one and older versions are no longer supported.
## AI discovered the ancient flaws
Security testing company Calif, engaged in OpenAI's Patch the Planet initiative, found one flaw using GPT five point six Sol.
## Responsible disclosure before public release
Both OpenAI and Wiz followed responsible security research practices, working with PHP on patches before publicly disclosing the flaws. They worked together to test patches with Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel.
## AI made old exploits dangerous
OpenAI says researchers found these flaws before hackers did, with no reports of exploits in the wild.Before AI, these flaws were too hard for hackers to exploit.

> LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts.
## Race to patch before attacks begin
Now that the issue is disclosed, hackers know about it.The NSA guidance is clear: if you cannot patch your PHP website immediately, pull it offline until you can.
## Key takeaway

The NSA warned of two critical PHP vulnerabilities found by AI that affect 33 million websites. Unpatched sites should go offline until they can update to PHP eight point five point one two.