US NSA Warns: OpenAI and Wiz Use AI to Find Critical PHP Flaws Affecting ~70% of Websites
The U.S. National Security Agency (NSA) issued an urgent warning on October 21, 2026, regarding two critical security holes found in PHP, a server-side programming language widely used for web applications. Since PHP powers roughly 70% of websites on the internet, including content management systems like WordPress, the disclosure has triggered global patching pressure. The NSA advised that if a website cannot be patched immediately, it should be pulled off the web until it can be.
The vulnerabilities were discovered by OpenAI and Google-owned cloud security firm Wiz. OpenAI found one flaw using GPT-5.6 Sol as part of its "Patch the Planet" initiative; the Wiz team identified multiple PHP vulnerabilities using their AI agent Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. Notably, these defects have existed since PHP version 5 was released in 2004 but were previously too complex for hackers to exploit at scale.
This event highlights the dual role of AI in cybersecurity. On one hand, AI tools can identify deep code flaws overlooked by human researchers, allowing for preventive disclosure before hackers find them. On the other hand, Large Language Models (LLMs) make it easier for attackers to adapt exploit code to different PHP versions, configurations, and memory layouts, significantly lowering the barrier to attack. "With AI this is no longer a barrier," Wiz warned in its blog post about the flaws.
The PHP Foundation has already issued patches for currently supported versions and recommends updating web servers to the latest PHP 8.5.12. Sites running unsupported older versions (such as PHP 8.1 and earlier) require additional update work. Although there are no reports of these vulnerabilities being exploited in the wild yet, a race against time has begun following public disclosure: millions of websites worldwide must complete patching before hackers launch large-scale attacks.
Sources:TechCrunch