The very foundation of the modern internet is facing a moment of reckoning after the National Security Agency issued a stark warning regarding two critical vulnerabilities discovered within PHP. As a server side language powering roughly seventy percent of all websites including millions of WordPress installations, PHP is essentially the invisible glue holding much of the digital world together. The flaws are so severe that federal authorities suggested any site unable to patch immediately should simply be taken offline to prevent attackers from infiltrating sensitive databases or file systems.
What makes this discovery particularly unsettling is that these security gaps have existed silently since 2004, lurking in every version of the language starting with version five. For twenty years, these holes remained undetected by human eyes and traditional scanners alike. However, the tide turned when artificial intelligence entered the fray. Through OpenAI’s Patch the Planet initiative and separate efforts by Google’s Wiz using advanced AI agents, these dormant vulnerabilities were finally dragged into the light.
This situation presents a strange paradox where AI acts as both the savior and the threat. While large language models allowed researchers to find and fix these errors before malicious actors could exploit them, those same tools now make attacking outdated systems significantly easier. Experts warn that AI can now automatically adapt exploits to fit various memory layouts and configurations, removing barriers that previously kept hackers at bay.
The race is now on for millions of website administrators to migrate to current versions of PHP, specifically version 8.5.12, as many older iterations are no longer officially supported. Because these flaws are inherent to the language rather than specific platforms like WordPress, users must coordinate directly with their hosting providers to secure their environments. With the blueprints for these attacks now public knowledge, the window for protection is closing rapidly across thirty three million vulnerable sites globally.
