Critical Vulnerabilities Found in PHP Using AI Tools

The US National Security Agency has issued an urgent warning after two critical vulnerabilities were discovered in the PHP programming language using AI tools from OpenAI and Google's Wiz. While the PHP Foundation has released patches for the vulnerabilities, a race against time has begun for millions of websites to be updated.

It was stated that these vulnerabilities, patched by the PHP Foundation, have been present in the language since version PHP 5, released in 2004. These vulnerabilities in the language, which powers approximately 70 percent of websites on the internet and is used by popular content management systems like WordPress, allow attackers to infiltrate the server file system or database. The US National Security Agency stated that sites that cannot be patched immediately should be temporarily taken offline.

During the discovery process of the vulnerabilities, security testing firm Calif and the Wiz team used AI agents as part of OpenAI's "Patch the Planet" initiative. In accordance with responsible security research principles, patches were prepared in collaboration with PHP. Experts warned that artificial intelligence not only enables the discovery of such vulnerabilities, which were previously very difficult to exploit, but also removes difficult barriers for attackers.