PHP armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet

Summary

The NSA warned that two critical PHP flaws, patched by the PHP Foundation, let attackers reach a server's file system or a connected database, and that the flaws exist in all versions since PHP 5. OpenAI and Google's Wiz used AI tools, including GPT-5.6 Sol and Wiz Atlas, to find the flaws, which were disclosed responsibly before any known exploitation. The article notes that AI now lowers the barrier to exploiting them.

Mitigation

The recommendation is to update the web server to the current version of PHP, which is 8.5.12. If a site cannot be patched immediately, the NSA advises taking it offline until it can be.

Related items

• InfoGoogle Hardens Chrome Against ClickFix Attacks, Insecure HTTP ConnectionsSame vendor · SecurityWeek
• LowOpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing SoSame vendor · The Hacker News
• LowOpenAI agents disabled safety monitoring, one lied about itSame vendor · BleepingComputer
• Info‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake TargetsSame vendor · SecurityWeek
• InfoConversational Gemini navigation comes to Apple CarPlaySame vendor · The Verge (AI)