AI uncovers 20-year-old PHP flaws. NSA tells unpatched websites to go offline.
AI just caught critical bugs hidden in PHP since 2004. The NSA is telling founders to patch immediately or pull their sites off the internet.
Tools · Source: TechCrunch
What happened
Two critical vulnerabilities were just discovered in PHP. This server-side programming language is an absolute giant. It powers roughly seventy percent of the entire internet. That is more than 33 million websites. These severe bugs have been hiding in plain sight for over two decades. They were tucked away in every single version of PHP since version 5 launched back in 2004. Security researchers finally caught them this week. They did it using advanced artificial intelligence models.
The US National Security Agency issued a blunt and alarming warning on Wednesday. They told organizations to take their systems completely offline if they cannot apply the security patch immediately. The flaws are that dangerous. They give attackers a direct path to infiltrate a server file system. They also expose any database connected to the web application. Major organizations panicked and pulled the plug. Finland temporarily shut down its public government web services. The cyber-security agency of the Netherlands took its own site offline. The Wikimedia Foundation pulled several systems down as a precaution, leaving parts of Wikipedia unavailable. Edinburgh council and the art platform DeviantArt also went dark.
OpenAI and Google Wiz drove this massive discovery. A security firm named Calif participated in the OpenAI Patch the Planet initiative. They used the GPT-5.6 Sol model to find one of the flaws. Separately, Wiz used its own Wiz Atlas security AI agent. They combined it with Gemini 4 Argon and GPT-5.6 Sol to find multiple vulnerabilities. Both teams followed responsible disclosure rules. They worked quietly with PHP maintainers to build patches before going public. The White House confirmed federal agencies are now working with leading AI labs to speed up remediation efforts.
Key facts
- 70% — Share of internet websites powered by PHP
- 2004 — Year PHP version 5 was released with these hidden flaws
- 8.5.12 — The current secure version of PHP that sites must update to
- 33 million — Estimated number of sites powered by PHP
Why it matters
Builders relying on older technology stacks face an immediate crisis today. PHP versions 8.1 and older are no longer supported by the maintainers. Upgrading to the secure version 8.5.12 requires significant manual work for legacy applications. If you run a WordPress site or a custom PHP application, you are in a race against time. Hackers now know exactly where these vulnerabilities exist. The internet is scrambling to patch tens of millions of websites before attackers can exploit the unpatched ones. You cannot afford to wait on this.
This event proves that AI is fundamentally changing the landscape of cybersecurity. Before AI tools existed, these specific flaws were simply too complex for human hackers to exploit easily. That barrier is now completely gone. Large language models can easily adapt an exploit to fit different PHP versions. They can adjust for different server configurations and memory layouts. AI is the only reason we found these ancient bugs in the first place. But AI is also the exact reason they are now highly dangerous in the wild. The offense and defense are both armed with the same powerful tools.
For builders
Audit your server stack immediately
Check if your web applications run on PHP today. If your servers are running version 8.1 or older, you must rewrite or migrate your code to support PHP 8.5.12. Founders who ignore this update risk severe data breaches and complete server takeovers. You pay the price if customer data leaks.
Prepare for hosting provider downtime
Web hosting companies are scrambling to patch their servers right now. Expect emergency maintenance windows and potential downtime across the internet. Communicate proactively with your users if your product relies on shared hosting platforms. Your reputation takes the hit if your site drops without warning.
Deploy AI for defensive security
The exact same AI models that found these flaws can audit your own codebase. You need to integrate AI security agents into your daily development pipeline. Companies that fail to use AI for defense will inevitably lose to attackers who use AI for offense.
My take
People keep warning me that AI will destroy the internet, but today AI literally saved it. Finding a twenty-year-old bug before hackers do proves to me that these models are the ultimate defensive weapon. We are entering an era where human security audits are no longer enough. If you are building software without AI security tools today, you are just waiting to get breached.
Original reporting: TechCrunch. This is my rewrite and opinion.