PHP vulnerabilities: NSA warns of two critical flaws in PHP
Two PHP vulnerabilities present since PHP 5 prompted an NSA warning to take unpatched websites offline, while AI tools helped researchers find them first.
The U.S. National Security Agency warned that two critical flaws had been found in PHP, and patches have been issued by the PHP Foundation.
The flaws could let attackers reach a server's file system or a database used by a web app.
They affect all PHP versions since version 5, released in 2004. PHP 8.1 and older are no longer supported.
The NSA advised taking any website that cannot be patched immediately offline until it can be fixed.
OpenAI and Wiz used AI tools to find the flaws. OpenAI said researchers found them before hackers did, and no exploits in the wild were reported.