PHP 'Armageddon': Two Critical Flaws Affect 70% of the Web, Found by AI

Executive Overview

The U.S. National Security Agency (NSA) on Wednesday disclosed two critical vulnerabilities in the PHP programming language, prompting emergency security releases from the PHP Foundation. The flaws affect approximately 70% of the internet—more than 33 million websites—and were discovered by AI models GPT-5.6 Sol from OpenAI and Wiz Atlas from Google. The mandatory fix is PHP 8.5.12, with a stark warning: unpatched sites should be taken offline immediately.

Deep-Dive Features & Architecture

The U.S. National Security Agency (NSA) revealed two critical vulnerabilities in PHP, a server-side programming language that powers roughly 70% of the internet—over 33 million websites—and is used in popular content management systems such as WordPress. The flaws exist in all PHP versions since version 5, released in 2004, meaning they remained hidden for two decades. The warning is severe: if a site cannot be updated immediately, it should be taken offline until the development team can patch it. The recommended current release is PHP 8.5.12, while versions 8.1 and older are no longer supported.

What makes this discovery unprecedented is that the two vulnerabilities were found by artificial intelligence. Under OpenAI's "Patch the Planet" initiative, security firm Calif used the GPT-5.6 Sol model to discover one of the flaws. In parallel, the Wiz team used its security agent Wiz Atlas with the Gemini 4 Argon and GPT-5.6 Sol models to discover multiple PHP vulnerabilities. Both OpenAI and Wiz followed responsible security research practices, working with the PHP Foundation to develop patches before public disclosure, then collaborating with major companies such as Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel to test the patches and ensure their effectiveness.

OpenAI confirmed that the vulnerabilities were discovered by researchers before attackers found them, and there have been no reports of exploitation in the wild. But that situation could change quickly, as Wiz warned in its blog: "Before AI, these vulnerabilities were extremely difficult for attackers to exploit. With AI, that is no longer a barrier. Large language models can help attackers adapt exploits to different PHP versions, configurations, and memory layouts." In other words, this is the kind of security problem that AI helped discover and prevent—but it also poses a high risk because of AI.

Benchmark & Competitive Performance

No traditional performance benchmarks apply to this security event. The relevant metrics are coverage and exposure: the flaws affect 70% of websites (over 33 million sites) and have existed since PHP 5 (2004). The recommended fix is PHP 8.5.12, while versions 8.1 and older are unsupported. There are no official speed or latency benchmarks tied to the disclosure; the focus is on security and stability.

Industry Impact & Enterprise Adoption

The disclosure has triggered urgent coordination across the hosting and CDN ecosystem. Updates are available immediately via official PHP repositories (php.net) and all major cloud providers (AWS, Google Cloud, Azure) and CDN companies (Cloudflare, Akamai, Fastly). WordPress issued a statement clarifying that the vulnerability is not specific to WordPress, but sites running the CMS use PHP and must update their servers and coordinate with hosting providers to ensure protection. The NSA's guidance is unambiguous: unpatched sites should be withdrawn from the internet until remediation is complete. No active exploitation has been reported, but public disclosure increases risk for unpatched systems.

Conclusion

The "PHP Armageddon" event marks a turning point in AI-assisted security research: two decades-old flaws affecting 70% of the web were found by GPT-5.6 Sol and Wiz Atlas, and patched through coordinated disclosure. The immediate action is clear—upgrade to PHP 8.5.12, retire unsupported versions, and take unpatched sites offline. The same AI capabilities that helped discover and prevent these flaws can also accelerate exploitation, making urgent patching a strategic imperative for every organization running PHP.

Media Source: TechCrunch AI | البيان الرسمي للشركة: المصدر الأصلي | Fact Verification & Analysis: AI Tools Oasis