Two critical PHP flaws discovered thanks to AI
In brief
- Two critical PHP flaws, used by 70% of websites, discovered thanks to AI tools.
- Patches exist but must be deployed urgently to prevent mass attacks on unpatched systems.
- AI speeds up both flaw detection and potential exploitation by attackers.
The U.S. National Security Agency (NSA) issued a warning on Wednesday about two critical vulnerabilities in PHP, a programming language used by roughly 70% of websites. The flaws, present since PHP version 5 (2004), allow access to a web app’s file system or database. Patches have been released by the PHP Foundation, but rapid deployment is critical, with the NSA advising to take unpatched sites offline temporarily.
The vulnerabilities were identified using AI tools, including GPT-5.6 Sol by OpenAI and Wiz Atlas with Gemini 4 Argon, as part of open-source security initiatives. OpenAI and Wiz collaborated with the PHP Foundation to develop and test patches before their release. Several companies, including Automattic, AWS, and Cloudflare, contributed to the verification process.
This discovery highlights both AI’s role in proactive flaw detection and the increased risk it poses: attackers could now exploit these vulnerabilities more easily using language models, accelerating the race to update millions of affected sites.
What it changes for you
- CybersecurityCybersecurity teams must prioritize updating PHP servers to prevent mass intrusions exploiting these vulnerabilities.
- Media & EntertainmentWeb platforms using PHP (such as media sites) must apply patches immediately to avoid disruptions or data leaks.
This summary gives you the essentials. The full article, its figures and quotes are on AI News & Artificial Intelligence | TechCrunch.
Read the original articleAI-generated summary of the source, checked by rules. How we write · Report an error