The U.S. National Security Agency issued an urgent warning on Wednesday about two critical vulnerabilities in PHP, the server-side programming language that powers roughly 70% of the internet — more than 33 million websites. The flaws, dubbed "PHP Armageddon," have existed in every version of PHP since version 5 was released in 2004, and patches have already been issued by the PHP Foundation.
The NSA's guidance is blunt: if a website cannot be patched immediately, it should be taken offline until it can be. The vulnerabilities allow attackers to infiltrate a server's file system or database, and they were discovered using AI tools from OpenAI and Google's Wiz — making this both a security issue prevented by AI and a high risk because of AI.
AI Found the Flaws — and AI Makes Them Dangerous
OpenAI disclosed that Calif, a security testing company engaged in its "Patch the Planet" initiative, found one of the flaws using GPT-5.6 Sol. Separately, the Wiz team used its Wiz Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol to find multiple PHP vulnerabilities.
Both companies followed responsible disclosure practices, working with the PHP Foundation on patches before going public. Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel for their help testing the fixes.
The Race to Patch Millions of Websites
OpenAI says researchers found these flaws before hackers did, and there were no reports of exploits in the wild at the time of disclosure. Historically, these vulnerabilities were too difficult for attackers to exploit reliably.
But Wiz warns that AI has removed that barrier. "With AI this is no longer a barrier. LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts," the company said in its blog. Now that the issue is public, hackers are fully aware, and the race is on to patch tens of millions of websites before unpatched ones are attacked.
