PHP armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet

The U.S. National Security Agency warned that two critical security holes have been discovered in PHP, a foundational server-side programming language that powers roughly 70 percent of internet websites. The PHP Foundation has already issued patches for the vulnerabilities, which affect all versions of the software released since 2004, including popular content management systems like WordPress.

OpenAI and Google’s Wiz disclosed that they independently uncovered the decades-old flaws using artificial intelligence tools. Security testing firm Calif used OpenAI's GPT-5.6 Sol under a "Patch the Planet" initiative, while the Wiz team utilized its Wiz Atlas security agent alongside Gemini 4 Argon and GPT-5.6 Sol. Both organizations followed responsible disclosure practices before publicizing the issues.

The vulnerabilities allow attackers to infiltrate underlying server file systems or connected databases. While no exploits have been reported in the wild prior to disclosure, Wiz warned that large language models remove previous barriers by helping attackers adapt exploits across different PHP versions and memory layouts. The NSA advised that websites unable to be patched immediately should be taken offline until updates are complete.

Because versions 8.1 and older are no longer supported, administrators must update their web servers to the current version, 8.5.12.

WordPress stated the