NSA warns of critical PHP vulnerabilities found by AI

A major flaw in the web's backbone

The National Security Agency (NSA) has issued an urgent warning to organizations regarding two critical security flaws in PHP. PHP is a programming language frequently used in web development, often described as the "backbone of the web" because it powers 70 percent of all websites globally.

Because of its widespread use, these vulnerabilities are significant. They affect popular platforms such as WordPress and Wikipedia's MediaWiki. The NSA warned that these flaws often provide a direct path for hackers to access a server's database or its file system.

The agency advised that if an organization cannot perform an immediate update, they should take their systems offline entirely until the issue is fixed. This move was prompted by reports of government websites in Europe and other regions going dark as the bug became known.

How AI discovered the hidden bug

In a notable shift in cybersecurity, these vulnerabilities were identified using artificial intelligence. Security researchers working with an OpenAI initiative used the company's GPT-5.6 Sol model to find a version of the bug. This highlights a growing trend where AI is used to scan code for weaknesses much faster than human engineers can manually check every line.

Despite being discovered by AI, the bug was not new. According to OpenAI President Greg Brockman, the flaw had been present in the code for 14 years. While a limited version of the bug was noticed in 2024, it was not initially considered a major threat until the recent AI-led discovery.

Brockman described the situation as a major find, stating that the vulnerability allows an attacker to "execute code on nearly all deployed PHP application." This means a hacker could potentially steal private user information or change the content of a website at will.

The response from the tech community

The discovery has triggered a rapid response from both government agencies and private tech companies. The cyber division of the Federal Bureau of Investigation (FBI) has urged organizations to act quickly and told users to watch for any signs of suspicious activity on their web services.

Developers of the PHP language released fixes on Wednesday morning. To help administrators manage the risk, OpenAI also released a PHP version checker within its Codex system. This tool allows operators to see if the specific version of PHP they are running is still vulnerable to the new flaws.

Researchers at Wiz described these findings as some of the most severe in the history of PHP and malware in general. They noted that while AI is a powerful tool for finding these holes, it also serves as a warning that bad actors could use similar technology to find and exploit vulnerabilities even faster.

What this means for users

For the average internet user, this means that the websites they visit daily—from news outlets to personal blogs—are currently undergoing emergency maintenance. Because the bug is so severe, many site owners are rushing to apply the patch to prevent their data from being exfiltrated or their pages from being defaced.

The FBI has instructed anyone who notices signs of a compromise to report the incident to a local field office or the Internet Crime Complaint Center. For now, the primary defense is the rapid deployment of the new code updates provided by the PHP developers.

This event underscores a new era of cybersecurity where AI acts as both a shield and a potential sword. As AI continues to be integrated into software development, the speed at which we find—and fix—critical errors will likely increase, requiring constant vigilance from the organizations that run our digital world.