AI-Assisted Research Finds Long-Standing PHP Vulnerabilities

Two critical vulnerabilities in PHP were disclosed after researchers from OpenAI and security company Wiz found flaws with the help of AI tools. The PHP Foundation issued patches, and the U.S. National Security Agency warned that websites unable to install them immediately should be taken offline until they can.

The flaws can let attackers access a server’s file system or a database used by a web application. They were present in every PHP version since version 5, released in 2004. PHP powers roughly 70% of websites, and some estimates put its reach at more than 33 million sites. WordPress also uses PHP, but said the vulnerabilities are not specific to its software; affected sites need to patch their servers.

PHP 8.1 and older releases are no longer supported. The source recommends updating to PHP 8.5.12. OpenAI said researchers found the flaws before hackers did, and there were no reported attacks exploiting them in the wild.

OpenAI said Calif found one flaw using GPT-5.6 Sol as part of its “Patch the Planet” initiative. Separately, Wiz said its team used the Wiz Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol to find multiple vulnerabilities. The companies worked with PHP on patches before disclosure. Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel for their help.

Wiz warned that AI can make exploitation easier by helping adapt an exploit to different PHP versions, configurations, and memory layouts. The disclosure has made the vulnerabilities public while many sites may still need to apply the patches.