Skip to content
Sign in
↑Part of: PHP flaws prompt website operators to take services offline
Technology · Global

OpenAI and Wiz find PHP vulnerabilities as foundation issues patches

AI-assisted research by OpenAI and Wiz uncovered vulnerabilities in PHP, prompting the PHP Foundation to issue fixes. Operators using unsupported releases should upgrade, with PHP 8.5.12 recommended.

AI-assisted synthesis · Based on 3 independent reports from 4 outlets · Article text read from 2 of 3 reportsHow it's made

View timeline · 8 entries
This story was corrected on Oct 22, 2026 following an editorial review.
4 outlets3 regionsLatest reporting 4 min readNo new reporting in 4 days
Coverage: Center OnlyL 0 · C 4 · R 0
File photo
Photo: Coolcaesar / Wikimedia Commons (CC BY 4.0)

What happened

Key facts

  • The U.S. National Security Agency warned that two critical vulnerabilities had been found in PHP; the PHP Foundation had issued patches.
  • OpenAI said GPT-5.6 Sol found one of the vulnerabilities.
  • The vulnerabilities have existed in PHP versions dating back to version 5, released in 2004.
  • PHP 8.1 and older versions are no longer supported; the recommended update is PHP 8.5.12.

The brief

OpenAI and Wiz used AI tools to identify critical vulnerabilities in PHP, and the PHP Foundation issued patches addressing two flaws. The U.S. National Security Agency warned that the vulnerabilities had been found, while the PHP Foundation urged users to prepare to update. The National reported that the security update might temporarily take millions of websites offline.

OpenAI said its GPT-5.6 Sol model found one of the vulnerabilities. The Wiz team reported using its Wiz Atlas security AI agent, Gemini 4 Argon and GPT-5.6 Sol to find multiple vulnerabilities. OpenAI said researchers discovered the flaws before hackers did.

A CISA news release characterized the vulnerabilities as enabling unauthenticated remote code execution in PHP installations serving web requests. That means the described flaw could allow code to run without a user first authenticating, according to CISA’s account. The PHP Foundation described the update as addressing two critical vulnerabilities.

The vulnerabilities date back to PHP version 5, released in 2004, according to TechCrunch. PHP 8.1 and older releases are no longer supported, and the recommended update is PHP 8.5.12. That leaves operators using unsupported versions facing an upgrade decision as the Foundation issues patches.

The coverage emphasizes different consequences: TechCrunch focuses on the discovery methods, the vulnerabilities’ long presence in PHP, and the recommended version; The National foregrounds the possibility that updating could temporarily take millions of websites offline. The National also reports that the Foundation encouraged PHP users to prepare for the update.

Wiz warned that large language models can help adapt an exploit to different PHP versions, configurations and memory layouts. The reporting does not establish that attackers exploited these vulnerabilities or that websites were actually taken offline because of the update.

Why it matters

  • The flaws date back to PHP 5, so organizations may need to check long-running websites and applications as well as newer deployments. The PHP Foundation has issued fixes, but operators on PHP 8.1 or older no longer receive support and should plan to move to a supported release, with PHP 8.5.12 recommended.

What to watch next

  • Whether PHP users prepare for and install the PHP Foundation’s security update.
  • Whether operators of PHP 8.1 and older systems move to the recommended PHP 8.5.12 release.
  • Whether any websites experience the temporary outages The National said the update might cause.
  • Whether evidence emerges that attackers exploited the vulnerabilities; Wiz warned that AI can help adapt exploits across versions and configurations.

How it's being covered

Coverage analysisShow details
4 source articles · 4 unique outlets · 3 distinct reports
Outlet political mix: Center Only· 4 Center
Where the outlets are based: Europe 50% · US/Canada 25% · Other 25%
Outlet political mix
Center Only
Left
Center
Right
0 outlets
4 outlets
0 outlets
The marker shows coverage balance: each unique outlet counts once.
Geography
Where the outlets covering this story are based.
4 unique outletsDominant coverage: Europe
Coverage imbalance
  • Coverage is currently concentrated among Center-rated outlets (4 of 4 rated sources); comparatively few Left or Right-rated outlets have published on the event.
How we measure coverage

How outlets' accounts compare

1 framing difference · 3 uncorroborated claims · 3 information gaps
The reports repeat the same account with different emphasis; its central claims are not independently confirmed in the reporting Updat3 read.Compared across 2 reports whose article text Updat3 read; 1 other outlet was checked by headline only.
Framing / emphasis differences
Sources emphasise different angles, actors or consequences of the same reporting.
  • TechCrunch emphasizes OpenAI’s and Wiz’s AI-assisted discovery, the flaws’ presence since PHP version 5, and the PHP 8.5.12 recommendation; The National emphasizes the possibility of temporary outages affecting millions of websites.
Updat3: These are differences of emphasis, not disputes about what is reported. They do not show that the reported claims are true.
One-sided or uncorroborated claims
Claims that come from one party or one source family and are not independently corroborated.
  • The National attributes the unauthenticated remote-code-execution description to a CISA news release.
  • Wiz warned that large language models can help adapt an exploit to different PHP versions, configurations and memory layouts.
  • OpenAI said researchers found the flaws before hackers discovered them.
Updat3: Not independently corroborated yet — treat as a claim, not an established fact.
Not established by the reporting
Information the available reporting does not contain or confirm. This is a gap, not a disagreement.
  • The sources do not quantify how many websites use unsupported PHP versions or how many would need to update.
  • The sources do not report confirmed exploitation, incident counts, or verified website outages caused by the vulnerabilities or update.
  • The National describes temporary outages as a possibility; the reporting does not establish that the update actually took websites offline.
Updat3: Updat3 cannot conclude anything about this from the current sources.

Timeline

Developments from this story's sources, dated background we compiled and fact-checked, and our earlier coverage. Each row says which.
  1. Rasmus Lerdorf created the tools that became PHP.
    Background · compiled and fact-checked by Updat3
  2. PHP made its first public release.
    Background · compiled and fact-checked by Updat3
  3. PHP 5, released in 2004, brought a major engine change and became a long-lived foundation for applications, frameworks, and hosting environments.
    Background · from our historical context
  4. PHP released version 5 with the Zend Engine 2 and a revised object-oriented programming model.
    Background · compiled and fact-checked by Updat3
  5. OpenAI was founded as an artificial intelligence research organization.
    Background · compiled and fact-checked by Updat3
  6. PHP released version 8.0.
    Background · compiled and fact-checked by Updat3
  7. The PHP Foundation was established in 2021 to support the language’s development and the work of core contributors.
    Background · from our historical context
  8. PHP released version 8.4.0.
    Background · compiled and fact-checked by Updat3

How we got here

PHP began as a set of tools created by Rasmus Lerdorf in the mid-1990s and grew into a general-purpose, open-source programming language widely used to build websites and web applications. Its long history matters to security work: code written for older versions may remain in use for years, even as the language evolves.

PHP 5, released in 2004, brought a major engine change and became a long-lived foundation for applications, frameworks, and hosting environments. A defect introduced or preserved in an early generation can therefore affect software well beyond the period when that generation was current.

Related developments3 stories
PHP security warnings send organizations into disruption
The PHP Foundation and the FBI’s cyber division warned of significant vulnerabilities in PHP, prompting government agencies, corporations and other organizations to react. The Jamaica Gleaner reported that some sites remained down and that experts expect further service disruptions as attackers scan for vulnerable systems.
2d ago
›
PHP Foundation acknowledges delayed fix as emergency patches address critical flaws
The PHP Foundation acknowledged that indecision and limited resources delayed a fix for a critical security flaw, while PHP issued emergency patches for two critical PHP2Shell vulnerabilities, according to The Hacker News headline. The Cointelegraph account said government websites and online services were disrupted amid concerns that the bug could let attackers take control of vulnerable servers.
4d ago
›
PHP vulnerabilities affect Australian Signals Directorate website
The Australian Signals Directorate said its cyber.gov.au website was among Australian government sites affected by a PHP software issue. Wiz estimated the vulnerability affected around 70 per cent of the internet, while OpenAI announced a separate Australian AI taskforce and cyber defence credits.
4d ago
›

Original sources

1 of 4 articles · US/Canada · Show all

Every story links to the reporting it was built from. How we choose sources

Spotted a factual error, a broken link or a misleading summary? Tell us.