NSA Warns Two PHP Flaws Affect 70% of Websites, Unpatched Sites Should Go Offline
Summary
The NSA warns that two critical PHP flaws affect roughly 70% of websites and says unpatched sites should go offline; patches exist and the current version is PHP 8.5.12. OpenAI says a Calif researcher using GPT-5.6 Sol found one hole, and Wiz says its AI agents found others. OpenAI says no exploits have been reported.
Key Points
- The two holes sit in every PHP version since 5, released in 2004.
- Wiz warns that LLMs can adapt an exploit to different PHP versions, configurations and memory layouts.
- WordPress says the flaws are not WordPress specific and site owners must patch servers and coordinate with hosting providers.