NSA warns of critical PHP holes found by OpenAI and Wiz AI

The PHP vulnerabilities are notable because they have existed since PHP version 5 was released in 2004, lying dormant across all subsequent versions. Their discovery was not the result of traditional security audits but of AI-assisted research: OpenAI's 'Patch the Planet' initiative and Wiz's AI agent each independently identified the flaws. This dual discovery underscores how AI can be used defensively to uncover long-standing bugs that were previously too difficult for humans to spot. However, Wiz also cautioned that AI lowers the barrier for attackers, as LLMs can help adapt exploits to different PHP versions and configurations. The coordinated disclosure involved multiple companies, including Automattic, Akamai, AWS, Cloudflare, and Microsoft, working with the PHP Foundation to patch the holes. With patches now available, the focus shifts to the massive patching effort across millions of websites, as the NSA's guidance to take unpatched sites offline highlights the severity of the risk.