PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet

THE NEWS

What happened

Critical security vulnerabilities have been discovered in PHP, a programming language powering approximately 70% of all websites globally, including major platforms like WordPress. The U.S. National Security Agency (NSA) has issued an urgent warning, advising that unpatched sites be taken offline immediately to prevent server infiltration and database breaches. These flaws, existing since PHP version 5 released in 2004, were recently identified by AI-driven security tools from OpenAI and Google's Wiz. The discovery highlights a paradigm shift where artificial intelligence has lowered the barrier for hackers to exploit decades-old code, turning previously untargetable weaknesses into immediate threats. Consequently, the global internet community faces a race against time to update millions of websites to the latest supported PHP version (8.5.12) before malicious actors can leverage AI to adapt exploits across different configurations.

CONTEXT

Why it matters

🚨 CRITICAL ALERT: PHP Armageddon The U.S. NSA has issued an urgent warning about severe vulnerabilities in PHP, the language running roughly 70% of all websites on the internet. 💡 Why this matters: These flaws have existed since 2004 but were previously too complex for hackers to exploit. Now, AI tools used by OpenAI and Google's Wiz have identified them, effectively removing that barrier. ⚠️ Immediate Action Required: The NSA advises taking unpatched sites offline immediately. Hackers are already aware of these holes. The race is on to update millions of websites to the latest PHP version (8.5.12) before attacks surge. This marks a pivotal moment where AI aids both defenders and attackers in real-time.

AT A GLANCE

Key facts

• The NSA issued an urgent warning regarding two critical vulnerabilities in PHP affecting roughly 70% of all websites on the internet.
• OpenAI and Google's Wiz used advanced AI models, including GPT-5.6 Sol and Gemini 4 Argon, to identify these flaws during security research initiatives.
• The vulnerabilities have existed since PHP version 5 was released in 2004 but were previously considered too difficult for hackers to exploit without AI assistance.
• The NSA recommends that websites unable to patch immediately should be taken offline until the update is complete.
• Hackers are now fully aware of these flaws, creating a race condition where unpatched sites are at high risk of immediate compromise.
• WordPress has clarified that while it uses PHP, the flaw is not specific to the CMS itself but affects the underlying server environment.