AI‑Driven Discovery of Decades‑Old PHP Vulnerabilities Triggers Massive Patch Race

The U.S. National Security Agency issued an urgent advisory after two severe vulnerabilities were found in PHP, the language powering roughly 70 % of the web. Both flaws have existed in every PHP release since version 5 (2004) and allow attackers to reach the server’s file system or underlying databases.

Researchers from OpenAI’s “Patch the Planet” program, aided by GPT‑5.6 Sol, discovered one of the bugs, while the Wiz team leveraged its Atlas security agent together with Gemini 4 Argon and the same GPT model to locate multiple issues. Both groups followed responsible disclosure, collaborating with the PHP Foundation and major hosts such as Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel to develop and test patches before public release.

According to Wiz, the complexity of these bugs previously kept them out of reach for typical attackers. Large language models now lower that barrier, enabling rapid adaptation of exploits across PHP versions, configurations, and memory layouts. Consequently, the disclosure has turned the situation into a race: millions of sites must upgrade to PHP 8.5.12 or be taken offline until patched.

Why it matters for GPU / AI infrastructure

AI‑accelerated vulnerability hunting demonstrates a double‑edged sword: the same GPU‑heavy models that power inference workloads can also automate the discovery of deep‑seated software flaws. Cloud providers running AI workloads must ensure their underlying web stacks are promptly patched, otherwise the very infrastructure used for AI could become an entry point for compromise.