NSA Issues Urgent Warning Over Massive Global PHP Vulnerability Discovered via AI
A severe global cybersecurity vulnerability affecting 70% of websites powered by PHP has forced the NSA to issue an urgent offline warning. Discovered with the help of AI models, researchers from Wiz and OpenAI worked on patches before an embargo breach caused widespread panic.
A massive global cyber security crisis unfolded this week following the disclosure of a critical vulnerability affecting approximately 70% of all websites and online services worldwide. The flaw, which was uncovered thanks to recent advancements in artificial intelligence, potentially turns the vast majority of global web infrastructure into a vector for powerful AI-driven attacks. The United States National Security Agency (NSA) issued a severe warning, advising organizations to take their websites offline immediately if they cannot apply software patches to mitigate the issue.
The Nature of the PHP Vulnerability
The vulnerability exists within the core code of PHP, a widely utilized open-source programming language that underpins the servers of nearly 70% of connected companies globally. While HTML dictates frontend presentation, PHP acts as the foundational brain, driving databases, user interactions, and backend operations. Platforms such as WordPress, Joomla, Drupal, and Wikipedia's MediaWiki rely heavily on PHP architectures. According to researchers at the Israeli cloud security firm Wiz—including Sagi Zadok, Shir Tamari, Nir Hofeld, and Tomer Schwartz—these fundamental bugs have persisted for decades.
"These basic bugs have existed for decades, but proving the ability to exploit them required particularly complex activity, beyond what human researchers could achieve. Edge AI models significantly lowered this barrier, turning an old bug into an exploitable weakness," the Wiz researchers wrote in a company blog post.
Coordinated Response and Premature Disclosure
The flaw was initially identified by PHP developers two years ago, but exploitation and remediation were considered exceedingly difficult, causing the issue to be deprioritized. However, the release of powerful AI models this past summer enabled firms like Wiz, Calif, and OpenAI to independently examine and map aspects of the vulnerability. Recognizing the immense risk, these companies collaborated with PHP developers to engineer comprehensive patches covering more than 300 different PHP files across various versions.
The global security community planned a coordinated disclosure and patch rollout. However, a partner firm broke the embargo to gain public attention, triggering global panic and prompting the NSA's unprecedented warning directive. Despite the chaos, no active exploits or damages have been officially reported yet, though security experts emphasize the urgent need for site administrators to update their systems or deploy specialized firewall mitigations immediately.
