PHP vulnerabilities came under sharp focus this week after the U.S. National Security Agency (NSA) warned that two critical flaws had been found in PHP, a programming language that powers a large share of the web. The agency said any website that cannot be patched immediately should be taken offline until it can be. Fixes have already been issued by the PHP Foundation, the group that maintains the language. The discovery is notable because AI tools helped find the flaws, and the same capability is now seen as a new source of risk.
Why these flaws matter
PHP runs on the server, so it handles a site's logic before the page reaches a visitor's browser. The language is widely used. By some accounts it powers roughly 70% of websites, which would be more than 33 million sites. It also underpins popular content management systems such as WordPress, the software many people use to build and run websites. The NSA said the holes could let attackers get into a server's file system or into a database that a web application uses.
The flaws have been present in all versions of PHP since version 5, which was released in 2004. PHP 8.1 and older releases are no longer supported, so sites on those versions need more than a routine update. The recommended step is to move to the current release, PHP 8.5.12.
How AI found the flaws
The security testing firm Calif took part in OpenAI's "Patch the Planet" initiative, which looks for weaknesses in open-source software. Using the GPT-5.6 Sol model, it found one of the flaws, OpenAI said in a blog post. Separately, Wiz used its Wiz Atlas AI security agent, along with Gemini 4 Argon and GPT-5.6 Sol, to find several vulnerabilities in PHP.
Both OpenAI and Wiz said they followed responsible disclosure, meaning they worked with PHP on fixes before making the flaws public. They then tested the patches with a group of other companies. OpenAI said researchers found the flaws before hackers did, so it had no reports of them being exploited in the wild. Wiz warned in its blog that AI removes an old barrier: large language models, the systems behind AI chatbots, can help an attacker adapt an exploit to different PHP versions, configurations and memory layouts. That is the core of the AI security risks here. Defenders gain a faster way to find flaws, and attackers may gain a faster way to use them.
WordPress said the flaw is not specific to its software. Sites running WordPress still need to patch their servers and check with their hosting companies to stay protected.
What site owners should do
The NSA's advice is direct: patch right away, and if that is not possible, take the website offline until the fix is in place. Owners should first check which PHP version their server runs, then ask their hosting provider whether the fix has been applied. With the details now public, the window to patch is shorter, because attackers have the same information. Reducing PHP vulnerabilities depends on acting quickly rather than assuming an older site is safe.
Aasan alfaaz mein
PHP ek aisi programming language hai jo bohat si websites chalati hai, aur is mein do sakht khamiyan mili hain jo hackers server tak pahunch sakti hain. Amreeka ki National Security Agency ne kaha hai ke website ko foran update karein, warna jab tak update na ho band rakhein. AI tools ne in purani khamiyon ko dhoondne mein madad ki, lekin yahi tools hackers ke liye bhi kaam asan kar sakte hain. Agar aap ki website ya online business PHP par chalti hai to apni hosting company se abhi poochein.
