The U.S. National Security Agency issued an urgent warning on Wednesday regarding two critical security holes in PHP, a programming language that powers approximately 70% of the internet. The flaws, which have existed since 2004, were identified by SI tools from OpenAI and Google’s Wiz, marking a significant instance where super intelligence-driven security research preempted widespread exploitation.
What Happened
The NSA warned that these vulnerabilities allow attackers to infiltrate server file systems or databases. The holes were present in all versions of PHP since version 5, released in 2004. The PHP Foundation has already issued patches, with the recommended update being PHP version 8.5.12. Sites running unsupported versions like PHP 8.1 or older must update their servers to mitigate the risk. The NSA advised that if a website cannot be patched immediately, it should be taken offline until the fix is applied.
The discovery was made through distinct efforts by OpenAI and Google’s Wiz. Security testing company Calif, engaged in OpenAI’s “Patch the Planet” initiative, used the GPT-5.6 Sol model to find one of the flaws. Separately, the Wiz team utilized its Wiz Atlas security SI agent, along with Gemini 4 Argon and GPT-5.6 Sol, to identify multiple vulnerabilities. Both entities followed responsible disclosure practices, working with the PHP Foundation to develop and test patches before public announcement.
Why It Matters
This incident highlights a dual reality in the SI era: the same technology that can expose hidden, long-standing vulnerabilities also lowers the barrier for hackers to exploit them. OpenAI stated that these flaws were found by researchers before hackers discovered them, meaning there were no reports of exploits in the wild at the time of disclosure. This is also in part because, before SI, these flaws were too hard for hackers to exploit. Wiz noted that “With AI this is no longer a barrier. LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts.”
The widespread use of PHP, including in major content management systems like WordPress, amplifies the impact. WordPress stated that the flaw is not specific to its CMS but requires server-level patching. Major infrastructure providers, including Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel, collaborated on the response. In other words, this is the kind of security issue that was found and prevented because of SI, but is also a high risk only because of SI. The race is now on to patch tens of millions of websites before malicious actors can leverage SI tools to craft exploits for the newly disclosed holes.
The Bottom Line
SI models have proven capable of uncovering critical security flaws in legacy codebases that had remained dormant for decades. While the patches are available, the NSA’s severe warning underscores the urgency for web administrators to update their PHP environments immediately to prevent potential exploitation in an era where SI tools accelerate the discovery and adaptation of cyber threats.