NSA warns organizations to patch security flaws identified by AI

The National Security Agency (NSA) warned organizations Wednesday to immediately patch a pair of security flaws or take their systems offline after artificial intelligence discovered vulnerabilities in a key programming language.

“Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities,” the NSA’s cyber division wrote in a post on the social platform X.

“These vulnerabilities often provide a direct path to the server’s file system or database,” the agency continued. “If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.”

PHP is a programming language frequently used in web development and is often referred to as the “backbone of the web.” It powers 70 percent of all websites around the world, including popular platforms like WordPress and Wikipedia’s MediaWiki.

The cyber division of the FBI similarly urged organizations to act quickly and users to monitor web services for suspicious activity. Users were told to report “signs of compromise” to a local FBI field office or the Internet Crime Complaint Center.

Developers of the PHP language released fixes to the vulnerabilities Wednesday morning after government websites in Europe and elsewhere went dark, urging users to “update immediately.”

The bug identified by security researchers has been present in the code for 14 years, OpenAI President Greg Brockman said Wednesday.

A limited version of the bug was initially discovered in 2024 but wasn’t deemed significant, he noted. In August, security researchers working with an OpenAI initiative and using the company’s GPT-5.6 Sol model found a version of the vulnerability.

“Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory,” Brockman wrote on X.

“This vulnerability allows any attacker to execute code on nearly all deployed PHP application, effectively allowing them to exfiltrate private user data or modifying the site however they want,” he added.

OpenAI also released a PHP version checker within its Codex system to help operators identify potentially vulnerable PHP versions.

“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in malware history,” researchers at Wiz wrote in a blog post Wednesday.

AI developers have often touted the technology’s ability to spot security vulnerabilities at significantly faster rates than humans or traditional computer systems, while warning the same tools can also be employed by bad actors.