PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet

Introduction

The U.S. National Security Agency has warned that two critical vulnerabilities—present in every version of PHP since 2004—have been discovered and patched. Because PHP powers roughly 70% of the web, the flaws pose a systemic risk. The discoveries were made by AI‑enhanced security teams at OpenAI and Google’s Wiz, highlighting both the power of large language models for defensive research and the new threat they pose if malicious actors adopt the same tools.

How AI Unearthed Ancient Flaws

OpenAI’s "Patch the Planet" initiative partnered with a security firm that used the GPT‑5.6 Sol model to scan PHP’s codebase. The AI identified one of the vulnerabilities, which OpenAI disclosed responsibly. Independently, Wiz leveraged its Atlas security AI agent, Gemini 4 Argon, alongside GPT‑5.6 Sol to locate additional weaknesses. Both groups followed coordinated disclosure practices, working with the PHP Foundation to develop and release patches before any public exploit emerged.

The Nature of the Vulnerabilities

The two bugs allow an attacker to gain arbitrary file‑system access or manipulate the underlying database of a web application. Because they are embedded in core PHP functions, any site running an unpatched version—especially those still on PHP 8.1 or older—could be compromised. The NSA’s guidance is stark: if a site cannot be patched immediately, it should be taken offline until the fix is applied.

Immediate Actions for Site Operators

1. Verify PHP Version – Check your server’s PHP version. If you are on anything older than the latest 8.5.12 release, plan an upgrade.
2. Apply the Official Patches – Download the security updates from the PHP Foundation and apply them to all environments (development, staging, production).
3. Coordinate with Hosting Providers – Major providers such as AWS, Cloudflare, Akamai, Fastly, Microsoft Azure, and Vercel have issued guidance and may already roll out patches on behalf of their customers.
4. Audit Your Codebase – Review any custom extensions or plugins that interact directly with the file system or database, ensuring they are compatible with the patched PHP version.
5. Monitor for Exploit Attempts – Enable logging and intrusion‑detection alerts that flag unusual file‑system or database activity.

The Broader Implications

The episode underscores a paradox in modern cybersecurity: AI dramatically accelerates the discovery of hard‑to‑find bugs, but it also lowers the barrier for attackers to weaponize those same flaws. Large language models can generate exploit code tailored to specific PHP versions, configurations, and memory layouts, turning a previously theoretical risk into an imminent threat.

Preparing for the AI‑Powered Threat Landscape

• Invest in AI‑augmented security testing – Adopt tools that use LLMs to continuously scan your stack for emerging vulnerabilities.
• Adopt a rapid patching cadence – Automate updates where possible and maintain a clear rollback plan.
• Educate development teams – Ensure engineers understand the security implications of legacy dependencies and the importance of staying current with language releases.

Conclusion

The discovery of these ancient PHP holes by OpenAI and Wiz demonstrates that AI can be a double‑edged sword in cybersecurity. While the responsible disclosures and swift patches have averted immediate disaster, the race now shifts to site owners worldwide: update, patch, and monitor before malicious actors leverage the same AI tools to launch attacks. The internet’s resilience depends on how quickly the community can move from discovery to remediation.