AI discovers PHP vulnerability that lay dormant for over a decade; NSA advises taking systems offline if they cannot be updated
OpenAI and Google-owned Wiz disclosed that researchers used AI to discover a severe security vulnerability in the PHP core engine, involving memory leaks and unauthenticated remote code execution, with a maximum severity score of 9.2 and affected versions dating back to PHP 5.4. The NSA has issued an emergency advisory requiring relevant organizations to update as soon as possible, and advising that systems be temporarily taken offline if they cannot be updated immediately. The PHP Foundation has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix the vulnerability. The Wiz research used the Wiz Atlas security agent, Gemini 4 Argon, and GPT-5.6 Sol.
Why read this
SelectedAI score 77
The original text explains the affected version range, the fixed versions, and the NSA's remediation advice, so readers can use it to judge the update priority of their own PHP deployments.
Topics
Body · AI translation
On October 22 Beijing time, OpenAI and Google-owned cybersecurity company Wiz disclosed that researchers had used AI to discover a serious security vulnerability in PHP. The U.S. National Security Agency (NSA) has issued an emergency advisory requiring affected organizations to update their systems as soon as possible; if they cannot update immediately, it recommends temporarily taking systems offline until the risk is fully mitigated.
PHP is a server-side programming language widely used for websites and web applications, and software such as WordPress, Drupal, and MediaWiki, which is used by Wikipedia, all rely on it. The issue disclosed this time lies in the PHP core engine and involves memory leaks and unauthenticated remote code execution. If an attacker successfully exploits it, they may gain control of affected servers or read sensitive information such as passwords, authentication tokens, and API keys.
According to Wiz, the related issues are classified under two vulnerability IDs, with a maximum severity score of 9.2, and affected versions can be traced back to PHP 5.4. Whether a vulnerability can be exploited depends on the specific version, configuration, and deployment; the widespread use of PHP cannot be directly equated with all related websites being compromisable.
The PHP Foundation has announced the release of PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix the above serious vulnerabilities. This means website operators can choose the corresponding security update according to the version branch they use, without necessarily upgrading to the 8.5 series across the board.
The discovery of this vulnerability involved multiple research teams using AI. OpenAI said that security company Calif, participating in its "Patch the Planet" program, used GPT-5.6 Sol to discover a critical vulnerability; Wiz also independently discovered and reported two vulnerabilities. PHP maintainers were responsible for fixing and releasing, while OpenAI, Wiz, and other partners participated in research, patch validation, and protection coordination.
Wiz disclosed that its research used the Wiz Atlas security agent, Gemini 4 Argon, and GPT-5.6 Sol. Researchers noted that such memory vulnerabilities previously required complex analysis, testing, and debugging, and repeated adjustments for different server environments. AI has reduced the difficulty of this work, making long-standing issues that were previously difficult to exploit in practice more feasible to attack.
OpenAI said that, according to the information it has, researchers discovered these vulnerabilities before attackers did, buying time for maintainers to prepare fixes and protective measures in advance. However, the same AI capabilities could also help attackers develop exploitation tools more quickly. As vulnerability details become public, whether website operators can deploy security updates in time becomes key to reducing risk going forward.