OpenAI and Google's Wiz Use AI to Find Critical PHP Flaws; US NSA Warns Millions of Sites to Patch or Go Offline
AI models discovered severe security vulnerabilities lurking in PHP for two decades, prompting the US National Security Agency to warn that unpatched sites should be taken offline.
The U.S. National Security Agency (NSA) issued an urgent warning on October 21, 2026, regarding two critical vulnerabilities found in PHP, a server-side programming language. Because PHP powers approximately 70% of websites globally, including major content management systems like WordPress, this discovery has raised widespread concerns about internet infrastructure. The NSA advised that if a website cannot immediately apply patches, it should be temporarily pulled from the web until repairs are complete.
These vulnerabilities were discovered by OpenAI and cloud security firm Wiz (owned by Google) using artificial intelligence. OpenAI's security testing partner Calif used the GPT-5.6 Sol model to locate one flaw as part of its "Patch the Planet" initiative; the Wiz team combined its Wiz Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol to find multiple PHP vulnerabilities. Notably, these defects have existed since PHP version 5 was released in 2004 but were previously too complex for hackers to exploit effectively.
Wiz noted in a blog post that AI has changed the game: "LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts." This means attack methods that previously required extreme expertise may now be automated via AI. Although OpenAI stated that researchers found these flaws before hackers did and there are no reports of exploits in the wild yet, public disclosure means hackers are now aware. The internet faces a race against time to patch tens of millions of websites before attacks occur.
The PHP Foundation has released patches for current versions (such as 8.5.12). Websites running older PHP versions (8.1 and earlier are no longer supported) need to upgrade. This incident highlights the double-edged sword of AI in cybersecurity: it helped defenders discover and patch potential catastrophic vulnerabilities early, but also lowered the technical barrier for attackers to exploit deep system flaws.