The National Security Agency warned Wednesday that two critical vulnerabilities had been found in PHP, the server-side programming language that underpins a huge share of the web. The PHP Foundation has already issued patches. The agency's advice was blunt: if a site cannot be patched right away, take it offline until it can.

PHP runs roughly 70 percent of websites, according to figures cited in the reporting, which by some accounts amounts to more than 33 million sites. It also powers popular content management systems such as WordPress. The flaws allow attackers to get into a server's file system or into a database the web application may use.

Which PHP versions are affected by the flaws?

The bugs are not new. They have been present in every version of PHP since version 5, released in 2004. Sites running older releases face the most work. PHP 8.1 and earlier versions are no longer supported, and the recommended step is to update to the current release, 8.5.12.

How were the PHP flaws found using AI?

What is new is how the flaws were found. AI tools played a central role. Calif, a security testing company, took part in OpenAI's "Patch the Planet" initiative, which looks for flaws in open-source software. Using GPT-5.6 Sol, the firm found one of the flaws, OpenAI said in a blog post.

Separately, the Wiz team used its Wiz Atlas security AI agent, Gemini 4 Argon and GPT-5.6 Sol to find multiple vulnerabilities in PHP. Both OpenAI and Wiz followed responsible security research practices, working with PHP on patches before making the flaws public. The groups then tested the fixes together with a wider set of companies. Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel for their help.

WordPress has said the flaw is not specific to its software. Sites running its CMS still need to patch their servers and work with their web hosts to make sure they are protected.

OpenAI said researchers found the flaws before hackers did, so there are no reports of exploitation in the wild. Part of the reason, the company said, is that before AI, the flaws were too hard for attackers to exploit. Wiz was direct about what has changed. "With AI this is no longer a barrier," the company wrote in its blog post. "LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts."

Why do these PHP flaws need patching right away?

That is the double-edged problem. AI helped find and head off the flaws, and it also makes them more dangerous. Now that the issue has been disclosed, attackers know where to look. The race is on to patch tens of millions of websites before hackers reach the ones still exposed. That is the reason behind the NSA's guidance, and it leaves site operators with little room to wait.

Este artigo foi escrito com a assistência de IA.
News Factory APP - notícias agênticas para impulsionar seu SEO e AEO.