PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet
techcrunch ·
The U.S. National Security Agency has issued an urgent warning regarding two critical security vulnerabilities discovered in PHP, a programming language that powers approximately 70% of websites globally. These flaws, which have existed since PHP version 5 was released in 2004, allow attackers to infiltrate server file systems and databases. The vulnerabilities were identified through AI-driven security testing by OpenAI and Google’s Wiz during their respective initiatives. Both organizations followed responsible disclosure practices, collaborating with the PHP Foundation to develop patches before public announcement. Because these ancient bugs are now easier for hackers to exploit thanks to large language models, there is a race to patch tens of millions of sites before malicious actors can take advantage. The NSA advises that any website unable to apply immediate updates should be taken offline until it is secure. While WordPress stated the issue is not specific to its CMS, users must ensure their underlying servers are updated. This incident highlights how AI both helped prevent widespread exploitation and simultaneously lowered the barrier for potential attacks.
techcrunch