- The US National Security Agency (NSA) warned that two serious security holes were found in PHP, and the source says the PHP Foundation has already released patches.
- PHP is a server-side programming language used to build websites. The source says about 70% of internet websites use it, and WordPress also uses it. According to the source, attackers could break into the server file system or the database used by web apps.
- According to the source, the two vulnerabilities may exist in all versions after PHP 5, which was released in 2004. PHP 8.1 and earlier versions are no longer supported, and the current version the source recommends is 8.5.12.
- AI was used in the discovery process. OpenAI said the security firm Calif found one vulnerability with GPT-5.6 Sol through OpenAI's Patch the Planet program. The source says Google's Wiz team also found several vulnerabilities using its own AI security agent and other tools, and this is a claim based on the two companies' announcements.
O: This can be used by individual bloggers or small business owners who run their sites on PHP 8.1 or earlier, to check the version in the hosting control panel and, before upgrading to 8.5.12 as the original recommends, make a backup first.
X: The vulnerability details and scope of impact come from explanations by the announcing parties, such as OpenAI and Wiz, and the original article has not independently verified them.