The National Security Agency issued an urgent cybersecurity directive on Wednesday, telling organizations that use the PHP programming language to install patches for two critical vulnerabilities immediately or disconnect their systems from the network. The warning follows the discovery of the flaws by artificial intelligence tools, which have increasingly been used to identify security weaknesses at scale.
“Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities,” the NSA’s cyber division wrote on X, the platform formerly known as Twitter. “These vulnerabilities often provide a direct path to the server’s file system or database,” the agency added. “If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.”
PHP is a widely used scripting language for web development, often described as the backbone of the internet. It powers roughly 70% of all websites globally, including major platforms like WordPress and Wikipedia’s MediaWiki. The vulnerabilities, which have been present in the code for 14 years, allow attackers to execute arbitrary code on virtually any PHP application, potentially enabling them to steal private user data or completely alter website content.
The FBI’s cyber division echoed the NSA’s urgency, urging organizations to act quickly and advising users to monitor web services for suspicious activity. The FBI also encouraged anyone who detects signs of compromise to report the incident to a local field office or the Internet Crime Complaint Center.
PHP developers released fixes on Wednesday morning, following reports that government websites in Europe and elsewhere had gone dark. The developers urged users to “update immediately,” underscoring the severity of the situation.
The vulnerabilities were initially identified in a limited form in 2024 but were not deemed significant at the time. In August, security researchers working with an OpenAI initiative and using the company’s GPT-5.6 Sol model uncovered a more dangerous version of the flaw. OpenAI President Greg Brockman said Wednesday that his team had been leading a coalition to mitigate what he called “one of the most severe bugs in open source software found in recent memory.”
“This vulnerability allows any attacker to execute code on nearly all deployed PHP applications, effectively allowing them to exfiltrate private user data or modify the site however they want,” Brockman wrote on X. OpenAI also released a PHP version checker within its Codex system to help operators identify potentially vulnerable PHP versions.
Security researchers at Wiz described the findings as “among the most severe vulnerabilities discovered in PHP, and arguably in malware history.” The discovery highlights the dual-edged nature of AI in cybersecurity: while the technology can spot flaws faster than humans, it can also be weaponized by malicious actors. As the situation develops, the NSA and FBI are urging organizations to prioritize patching, as the potential for widespread exploitation remains high.
