PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet

The NSA warned that two critical vulnerabilities found in PHP, which powers roughly 70% of websites, allow attackers to infiltrate a server's file system or database, and urged sites that cannot be patched immediately to be taken offline. The flaws have existed in all PHP versions since version 5 (2004), and the recommendation is to update to PHP 8.5.12, since PHP 8.1 and older are no longer supported. OpenAI's Calif found one flaw using GPT-5.6 Sol under the "Patch the Planet" initiative, while Wiz used its Atlas agent with Gemini 4 Argon and GPT-5.6 Sol to find multiple vulnerabilities; both worked with PHP on patches before disclosure, and no exploits in the wild have been reported.