PHP doomsday: OpenAI and Google's Wiz find long-standing vulnerabilities, sending the internet into panic

The US National Security Agency (NSA) warned on Wednesday that two critical vulnerabilities in PHP could allow attackers to compromise the server file system or the databases used by web applications. The PHP Foundation has released patches, and websites that cannot patch immediately should go offline first. The vulnerabilities have existed in all versions since PHP 5, released in 2004, and PHP powers about 70% of websites, or more than 33 million sites according to some counts; WordPress stated that the vulnerabilities are not specific to it, and that sites need to patch the server and coordinate with their hosting provider. The vulnerabilities were found by AI: security company Calif, participating in OpenAI's Patch the Planet program, used GPT-5.6 Sol to find one of them, while the Wiz team used the Wiz Atlas security AI agent, Gemini 4 Argon and GPT-5.6 Sol to find multiple vulnerabilities; both parties followed responsible disclosure and completed patch testing before public disclosure. Updating to the current version, PHP 8.5.12, is recommended; PHP 8.1 and earlier versions are no longer supported.