AI News Feed
Market watch
SpaceX Shares Rise 7% as Musk Flags Power, Cooling as AI ConstraintsAI-Discovered PHP Flaws Take Government Sites Offline as Other Security Crises MountEllie & Natasia Season 2 Returns to BBC iPlayer and BBC TwoSamsung Good Lock’s Dropship module fails to share files with iPhonesiPadOS 27.2 Brings Mac-Style Siri Popup for Selected TextNVIDIA's Kumo Relational Predicts Directly on Enterprise Databases Without Training
SpaceX Shares Rise 7% as Musk Flags Power, Cooling as AI ConstraintsAI-Discovered PHP Flaws Take Government Sites Offline as Other Security Crises MountEllie & Natasia Season 2 Returns to BBC iPlayer and BBC TwoSamsung Good Lock’s Dropship module fails to share files with iPhonesiPadOS 27.2 Brings Mac-Style Siri Popup for Selected TextNVIDIA's Kumo Relational Predicts Directly on Enterprise Databases Without Training
Cybersecurity

NSA Warns of Critical PHP Flaws Found With AI, Urges Unpatched Sites Offline

The U.S. NSA warned that two critical PHP vulnerabilities affect a language used by about 70% of websites and urged unpatched sites to go offline; OpenAI and Wiz found the flaws using AI.

AI News Feed · 2026-10-22 04:36

PHP is used so widely for web applications that it powers about 70% of websites, by some accounts more than 33 million sites, and is used by popular content management systems such as WordPress. The flaws have existed in all versions of PHP since version 5, released in 2004, according to the report. Sites running PHP 8.1 or older face more work because those versions are no longer supported; the recommendation is to update to PHP 8.5.12, the current version.

The discovery came through AI security work. OpenAI said in a blog post that Calif, a security testing company participating in OpenAI's 'Patch the Planet' initiative, found one flaw using GPT-5.6 Sol. Separately, Google's Wiz said its team used its Wiz Atlas security AI agent, Gemini 4 Argon and GPT-5.6 Sol to find multiple vulnerabilities in PHP.

OpenAI and Wiz said they followed responsible security research practices and worked with PHP on patches before public disclosure. They then worked with others to expand the findings and test the patches. Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel.

WordPress, which runs on PHP, said in a statement that the flaw is not WordPress-specific and that sites using its CMS must patch their servers and work with their web-hosting companies to ensure protection, according to TechCrunch.

OpenAI said researchers found the flaws before hackers did, and there were no reports of exploits in the wild. The company and Wiz attributed that in part to the difficulty of exploiting the flaws before AI. Wiz warned in its blog that large language models can now help adapt an exploit to different PHP versions, configurations and memory layouts, removing a barrier that had made the flaws hard to exploit.

With the flaws now public, hackers are aware of them. The race is on to patch tens of millions of websites before attackers target unpatched ones, which is why the NSA recommended taking a PHP site offline if an immediate patch is not possible.