Critical 'PHP2Shell' flaws, two decades old, found with help from OpenAI and Wiz AI tools
The US National Security Agency issued a warning about two critical flaws in PHP, the programming language that powers roughly 70% of websites on the internet, flaws that had sat hidden in every version since 2004 and let an attacker break into a server's file system or database. The flaws, now known as PHP2Shell, were found with the help of AI: one by security testing firm Calif as part of OpenAI's 'Patch the Planet' initiative using the GPT-5.6 Sol model, and the rest by Wiz's team using its own Wiz Atlas security agent combined with the Gemini 4 Argon and GPT-5.6 Sol models. Both teams followed responsible disclosure, working with the PHP Foundation to prepare patches before anything was made public, while the NSA recommended immediately pulling offline any website that can't be updated right away to the current PHP 8.5.12 release. The case stands out because it shows the upside of using AI in security: tools like these found twenty-year-old flaws in a matter of weeks that no one had caught until now. For a business running a website or application on PHP, especially an older version like 8.1, the NSA's recommendation means updating immediately or taking the site offline temporarily, not waiting for the next scheduled maintenance cycle.
Sources
This summary was written automatically with AI from the public sources listed above and checked by an independent AI reviewer before publication. For full details, read the original source.