PHP Armageddon: OpenAI, Google Wiz find ancient holes
Two flaws dating back to PHP 5 affect roughly 70 percent of websites; the PHP Foundation shipped 8.5.12 and the NSA urged sites that cannot patch immediately to be taken offline.
The NSA warned on October 21 that two critical PHP vulnerabilities require immediate patching or taking sites offline. PHP powers roughly 70 percent of websites and more than 33 million sites. Security firm Calif found one flaw using GPT-5.6 Sol under OpenAI's Patch the Planet program, while Google's Wiz used its Wiz Atlas agent with Gemini 4 Argon and GPT-5.6 Sol to find multiple issues. The flaws date back to PHP 5 released in 2004. The PHP Foundation shipped version 8.5.12. Wiz said LLMs remove the exploitation barrier by adapting exploits to different versions and memory layouts. OpenAI reported no in-the-wild exploitation before disclosure.