The U.S. National Security Agency (NSA) issued a stark warning on October 21, 2026, regarding two critical security vulnerabilities discovered in PHP, the widely used server-side programming language that supports approximately 70% of all websites globally, including major platforms like WordPress. These security holes, traced back to PHP version 5 released in 2004, pose severe risks by allowing attackers to access web servers' file systems and databases. The PHP Foundation has already released patches, and the NSA advised that any websites unable to apply these updates immediately should consider going offline to prevent potential breaches.

The discovery of these vulnerabilities was largely enabled by advances in artificial intelligence. OpenAI and Google’s security firm Wiz utilized AI tools, including OpenAI’s GPT-5.6 Sol and Wiz’s Gemini 4 Argon agent, to identify and analyze the flaws as part of responsible security research efforts. OpenAI participated through its “Patch the Planet” initiative, revealing the vulnerabilities before any known exploitation in the wild. Collaborations among OpenAI, Wiz, the PHP Foundation, and other tech giants such as Automattic, AWS, Cloudflare, and Microsoft contributed to patch development and testing.

Despite the absence of active exploits so far, the nature of these vulnerabilities has changed with AI capabilities making it easier for hackers to adapt attacks across various PHP versions and configurations. This shift underscores a paradox where AI played a crucial role in detecting and preventing these ancient flaws but simultaneously lowers the barrier for malicious actors to exploit them rapidly once public disclosure occurred. Wiz highlighted the urgency for widespread and immediate patching efforts to safeguard millions of affected websites.

WordPress clarified that the flaw itself is not tied specifically to its content management system but stressed that users must work closely with their hosting providers to apply the necessary patches promptly. With PHP 8.1 and earlier releases no longer supported, updating servers to the latest PHP version 8.5.12 is strongly recommended. The current situation has triggered widespread concern across the internet ecosystem as organizations rush to secure their PHP-powered sites against the new threat landscape amplified by AI-driven vulnerabilities.