Decades-Old PHP Vulnerabilities Exposed by AI Security Agents

The vulnerabilities, discovered through initiatives involving OpenAI’s “Patch the Planet” project and security firm Wiz, affect nearly every version of the language released over the last two decades. While the PHP Foundation has already issued patches, the scale of the threat is immense, impacting an estimated 33 million websites, including those running on popular content management systems like WordPress. The flaw allows unauthorized actors to infiltrate server file systems or backend databases, a risk previously considered too complex for manual exploitation but now made accessible through large language models.

OpenAI and Wiz identified these weaknesses before they were leveraged by malicious actors, marking a rare instance where the same technology that lowers the barrier for attackers also enabled proactive defense. Despite this, the public disclosure has initiated a high-stakes race between system administrators and hackers. With older iterations like PHP 8.1 no longer receiving official support, the onus falls on web hosts and developers to migrate to the current version, 8.5.12. Industry leaders including Akamai, AWS, and Cloudflare have joined the effort to secure the infrastructure, yet the NSA’s blunt warning underscores the severity of the situation: for many, the only way to ensure safety is to disconnect vulnerable services until the update is complete.