PHP armageddon: OpenAI, Google's Wiz find ancient holes, panicking the internet

Key Points:

• The U.S. National Security Agency (NSA) issued a critical warning about two severe security vulnerabilities found in PHP, a server-side programming language used by roughly 70% of websites, including popular platforms like WordPress.
• These vulnerabilities, present in all PHP versions since 5 (released in 2004), allow attackers to access server file systems or databases, prompting the NSA to recommend immediate patching or temporarily taking affected websites offline.
• The flaws were discovered through AI-powered security research initiatives by OpenAI and Wiz, who responsibly collaborated with the PHP Foundation and industry partners to develop and test patches before public disclosure.
• Although no exploits have been reported in the wild yet, AI tools have lowered the barrier for hackers to exploit these vulnerabilities, intensifying the urgency for website operators to update to the latest PHP version (8.5.12) promptly.
• The situation underscores a dual role of AI in cybersecurity: enabling the detection and prevention of long-standing flaws while simultaneously increasing the risk of rapid exploitation if patches are delayed.