NSA warns of two critical PHP flaws present since version 5
Original title: PHP armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet
OpenAI and Wiz say the holes were found before attackers; unpatched sites should go offline, and PHP 8.5.12 is recommended.
The NSA warned Wednesday that two critical PHP flaws, present since version 5 in 2004, can let attackers reach a server file system or an application database. The PHP Foundation has issued patches; the report recommends PHP 8.5.12, while PHP 8.1 and older are unsupported. Calif, under OpenAI’s Patch the Planet effort, used GPT-5.6 Sol for one flaw, and Wiz used Atlas with Gemini 4 Argon and GPT-5.6 Sol. Both coordinated disclosure. OpenAI says there were no reports of exploitation.
Unconfirmed: The item does not name CVE identifiers or say which supported PHP branches besides 8.5.12 received fixes.
- PHP powers roughly 70% of websites, more than 33 million by some accounts.
- WordPress said the flaws are not CMS-specific and hosts must patch PHP.
- Wiz said LLMs can adapt exploits across versions, configurations, and memory layouts.
- Named helpers include Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel.
Impact: access a server file system or web-app database
| Product | Affected | Fixed in |
|---|---|---|
| PHP Foundation PHP | all versions since PHP 5; PHP 8.1 and older unsupported | 8.5.12 |
- 1.Update web servers to PHP 8.5.12.
- 2.Take sites offline if they cannot be patched immediately.
- 3.WordPress operators should patch PHP and coordinate with their hosts.
- Vendors
- PHP Foundation
- Countries
- United States
- AI models
- GPT-5.6 SolGemini 4 Argon
From the original article
2 min read at techcrunch.com
This is the kind of security issue that was found and prevented by AI, but is also a high risk because of AI.
By Julie Bort · techcrunch.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.