PHP armageddon: OpenAI, Google's Wiz find ancient holes, panicking the internet
News Source
β’Wed, 21 Oct 2026 17:59:12 +0000
π° What Happened
US security officials have warned about two serious security holes in PHP, the code that runs about 70% of the world's websites. The NSA says sites that cannot update straight away should be taken offline.
The holes could let attackers break into a server's files or databases. They have existed in every version of PHP since 2004. The PHP Foundation has released fixes, and the current safe version is 8.5.12.
π The Backstory
The flaws were found using AI. OpenAI's security programme used GPT-5.6 Sol to spot one. Google's Wiz team used its own AI agents to find others. Both told the PHP team before going public, so no attacks have been reported.
The catch is that AI also makes the holes easier to exploit. Tools can now adjust an attack to fit different servers. Millions of sites, including many built on WordPress, must update fast.
π― Why It Matters
If your bank, school or favourite shop runs old PHP, its data is at risk. Website owners should update now rather than wait for an attack.
US security officials have warned about two serious security holes in PHP, the code that runs about 70% of the world's websites. The NSA says sites that cannot update straight away should be taken offline.
The holes could let attackers break into a server's files or databases. They have existed in every version of PHP since 2004. The PHP Foundation has released fixes, and the current safe version is 8.5.12.
The flaws were found using AI. OpenAI's security programme used GPT-5.6 Sol to spot one. Google's Wiz team used its own AI agents to find others. Both told the PHP team before going public, so no attacks have been reported.
The catch is that AI also makes the holes easier to exploit. Tools can now adjust an attack to fit different servers. Millions of sites, including many built on WordPress, must update fast.
If your bank, school or favourite shop runs old PHP, its data is at risk. Website owners should update now rather than wait for an attack.