NSA Urges Immediate PHP Patching Following Discovery of Critical Vulnerabilities

OPA WIRE, Oct 21 (OPA) — The U.S. National Security Agency (NSA) advised administrators on Wednesday to patch PHP-based servers immediately or take them offline to prevent potential exploitation. The vulnerabilities, which affect versions dating back to 2004, allow attackers to infiltrate file systems or databases. PHP powers an estimated 33 million websites, including those utilizing the WordPress content management system.

Researchers from OpenAI and security firm Wiz identified the flaws using artificial intelligence tools, including OpenAI’s GPT-5.6 Sol and Wiz’s Atlas agent. OpenAI confirmed that the vulnerabilities were identified and patched through responsible disclosure practices before any known exploits occurred in the wild. The PHP Foundation has released patches for the affected versions, with experts recommending an immediate upgrade to PHP version 8.5.12.

While the flaws remained dormant for two decades, security experts warn that AI has lowered the barrier for entry for malicious actors. Wiz noted that large language models can now assist in adapting exploits to various PHP configurations and memory layouts, effectively turning previously difficult-to-exploit bugs into immediate threats. The discovery was part of a collaborative effort involving major infrastructure providers, including AWS, Cloudflare, Fastly, and Microsoft.

With the vulnerabilities now publicly disclosed, the focus shifts to the global race to secure millions of unpatched servers. WordPress has clarified that the issue is not specific to its software, urging site owners to coordinate directly with their web-hosting providers to ensure server-side updates are applied. The NSA guidance remains the primary directive for organizations unable to implement the patches immediately.