Two critical vulnerabilities affecting PHP, a programming language used across a large share of websites, have been identified and patched. The flaws were present in PHP versions dating back to version 5, released in 2004, and could potentially allow access to a web server's files or application database.
AI supports discovery and coordinated fixes
Researchers working with OpenAI's "Patch the Planet" initiative used GPT-5.6 Sol to identify one flaw. Separately, Wiz researchers reported finding multiple vulnerabilities with the help of AI security tools, including Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol.
OpenAI and Wiz coordinated with the PHP Foundation and other organizations to verify the findings and prepare patches before public disclosure. OpenAI said the vulnerabilities were identified before researchers found evidence of exploitation in the wild.
PHP 8.1 and earlier releases are no longer supported. Website operators are advised to update to a supported PHP version; the release listed in the advisory is PHP 8.5.12. The U.S. National Security Agency also advised taking a site offline temporarily if it cannot be patched promptly. WordPress sites are not affected specifically by the content management system, but their PHP servers may need updates.
The case highlights AI's dual role in cybersecurity: it can help researchers uncover weaknesses, while also potentially making it easier to adapt attacks. As AI tools advance, coordinated disclosure and timely software updates are likely to become increasingly important to protecting the web.
