Critical PHP Flaws Put Millions of Websites at Risk

Critical PHP flaws put websites at risk The U.S. National Security Agency warned that two critical vulnerabilities had been found in PHP, a server-side programming language used by roughly 70% of websites and by popular content management systems such as WordPress. The PHP Foundation had already issued patches, but the NSA said the flaws were severe enough that sites unable to install them immediately should be taken offline until they can be secured. The vulnerabilities can let attackers infiltrate a server’s file system or access a database used by a web application. That exposure puts both the website’s underlying files and its stored data at risk. PHP’s widespread use means the warning applies to a large number of sites: the source article estimates that the language powers more than 33 million websites by some accounts. With the flaws now publicly disclosed, the NSA’s guidance emphasizes the urgency of acting. Site operators who can patch should do so; those who cannot patch right away are advised to pull their websites off the web in the meantime. Leaving an affected site online without a patch could give attackers an opportunity to reach its server or database. Affected versions and recommended updates The flaws have been present in PHP versions dating back to version 5, released in 2004. That long history means websites running older PHP releases may need to update to a supported version to address the vulnerabilities. PHP 8.1 and older versions are no longer supported. Websites using those releases will need to move to a newer version; the article recommends updating the web server to PHP 8.5.12, the current version cited in its report. The NSA warned that the vulnerabilities are severe enough that websites unable to patch immediately should be taken offline until they can be updated. The flaws could allow attackers to infiltrate a server’s file system or a database used by a web application. Website operators should check which PHP version their servers run and arrange the recommended update. WordPress sites are not affected in a WordPress-specific way: the CMS has said sites must patch their servers and work with their web-hosting companies to ensure they are protected. How OpenAI and Wiz found the vulnerabilities The flaws came to light through separate AI-assisted security efforts. Security testing company Calif was participating in OpenAI’s “Patch the Planet” initiative, which seeks to find vulnerabilities in open-source software. Using GPT-5.6 Sol, Calif found one of the PHP flaws, OpenAI said in a blog post. Separately, Wiz’s team used several AI tools to uncover multiple PHP vulnerabilities: its Wiz Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol. The findings showed how AI could help researchers identify weaknesses in widely used software, including flaws that had gone unnoticed for years. Both teams followed responsible security research practices, coordinating with PHP on patches before publicly disclosing the vulnerabilities. They then worked with PHP to investigate the findings further and test the fixes, with other organizations also contributing to the effort. Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel for their help. Disclosure raises urgency as AI lowers barriers OpenAI said researchers found the flaws before hackers did, and there were no reported exploits in the wild. But Wiz warned that AI changes the risk: “LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts.” Once the vulnerabilities were disclosed, attackers had the details, raising pressure on website operators to patch before they could be targeted. WordPress said the issue is not specific to its platform. It advised sites running its CMS to patch their servers and work with their web-hosting companies to ensure they are protected. The researchers and PHP worked together on patches and testing, with support from industry contributors. Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel. The disclosure underscores the double-edged role of AI: it helped researchers uncover and address flaws, while also making it easier for attackers to adapt exploits to varied PHP environments.