The U.S. National Security Agency has issued a stark warning: critical vulnerabilities have been found in PHP, the programming language behind over 70% of websites. These flaws, hidden in PHP since 2004, could allow attackers to infiltrate server files or databases used by web applications. Websites running older versions of PHP, including PHP 8.1 and earlier, are at risk.

These vulnerabilities were discovered by AI-powered security companies. OpenAI’s GPT-5.6 Sol and Google’s Wiz team used advanced AI to find and disclose the flaws, working closely with the PHP Foundation to ensure a coordinated response. The race is now on for web developers to update their sites to the latest version, PHP 8.5.12, to avoid becoming targets.

The disclosure has led to a scramble to patch millions of websites, with the NSA recommending that sites be taken offline if they can’t be updated immediately. This unprecedented use of AI in security research highlights both the power and the risk it poses to internet safety. As Wiz notes, while these flaws were found before hackers, AI has made exploiting them far easier.

This is a stark reminder that while AI can help us find and fix security issues, it also creates new risks. The internet’s largest vulnerabilities might now be within the reach of anyone with the right tools and knowledge. The race to patch is on, but the threat of a potential cyber-attack looms large.