AI Tools Uncover Two-Decade-Old PHP Flaws as NSA Urges Urgent Patching
aiinsider ·
The U.S. National Security Agency has issued an urgent warning regarding two critical vulnerabilities in PHP, a server-side programming language that powers approximately 70% of websites, including those built on WordPress. These security flaws have been present in every version of the software since 2004 and could allow attackers to access a server’s file system or connected databases. Both vulnerabilities were discovered using advanced AI tools, with OpenAI’s GPT-5.6 Sol identifying one flaw through its Patch the Planet initiative and Google’s Wiz finding multiple issues using its Wiz Atlas agent. The PHP Foundation has already released patches for these defects, advising organizations to upgrade immediately to the current supported version, 8.5.12. Sites running unsupported versions like PHP 8.1 are strongly urged to update, or alternatively, take their systems offline until they can be secured. While OpenAI reports that no exploits have been known to exist yet, Wiz cautions that AI capabilities lower the barrier for attackers to adapt these flaws across different configurations. This discovery highlights a growing race to patch millions of sites before malicious actors can leverage similar AI-driven techniques.
aiinsider