The U.S. National Security Agency issued an urgent advisory on Wednesday highlighting two critical vulnerabilities in the PHP programming language that affect an estimated 70% of websites globally. The flaws, present in PHP versions dating back to 2004, could allow attackers to access server file systems or databases if left unpatched. The PHP Foundation confirmed patches are now available, but the agency recommended immediately disconnecting unpatched sites from the internet until updates can be applied.

PHP powers more than 33 million websites, including major content management systems like WordPress. While WordPress clarified the vulnerabilities are not specific to its platform, site administrators must coordinate with hosting providers to implement fixes. The vulnerabilities were discovered through AI-driven security research: OpenAI’s Patch the Planet initiative identified one flaw using GPT-5.6 Sol, while Google’s Wiz team used its Wiz Atlas AI agent alongside GPT-5.6 Sol to uncover additional issues. Both groups followed responsible disclosure practices, collaborating with PHP developers to create patches before public disclosure.

Security researchers noted that AI has lowered barriers for exploiting such longstanding flaws, as machine learning models can now adapt exploits across diverse PHP configurations and memory layouts. This development has intensified pressure on website operators to update to PHP 8.5.12, the latest supported version, as older versions (including PHP 8.1 and earlier) are no longer maintained. The NSA’s warning underscores the urgency of patching, as malicious actors now possess the tools to target unpatched systems at scale.

The coordinated effort involved major technology companies including Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel in testing and validating fixes. While no active exploits have been reported, the advisory emphasizes that the window to prevent widespread compromise is narrow. Website operators are advised to verify their PHP versions and apply updates through official channels to mitigate potential risks.

This incident reflects a growing intersection of artificial intelligence and cybersecurity, where advanced tools both reveal vulnerabilities and accelerate their remediation. The NSA’s guidance aligns with standard industry practices for critical infrastructure protection, prioritizing proactive risk mitigation over reactive crisis management.