Two critical flaws in PHP, the programming language behind a large share of the web, from government services to online stores and banks, can, under the right conditions, let an attacker take over the computers that serve websites without logging in. PHP's maintainers released fixes on Oct. 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. AI helped find at least one. OpenAI says the security firm Calif found one using its GPT-5.6 Sol model, through Patch the Planet, an OpenAI program that helps the people who look after free, open-source software. The PHP Foundation says OpenAI separately reported the same underlying problem.
The PHP Foundation says both flaws sit in parts of PHP that nearly every visit to a website touches: how PHP handles memory and how it handles errors. A request designed to make PHP run out of memory, or hit an error, at just the wrong moment can leave the server's memory scrambled, and under the right conditions attackers can use that to run their own commands on the server. On the setup PHP rates riskiest, that can happen before the website's own code even runs. The NSA says the flaws are in PHP itself, not in the sites built on it, and could let attackers steal data, disrupt services or reach other computers on the same network.
CISA, the U.S. cyber defense agency, urged organizations to patch at once, and to take PHP systems offline if they cannot update right away or still run PHP 8.1 or older. The NSA says the risk is serious enough to require immediate patching across U.S. government departments, and the U.K.'s National Cyber Security Centre urged British organizations to act immediately. On Oct. 26, CISA added both flaws to its catalog of known exploited vulnerabilities, its list of weaknesses it knows attackers are using. Amazon says its decoy servers logged an attempt to use the flaws on Oct. 17, four days before they were made public, and that attempts are now widespread.
The memory flaw was not new to PHP's own team. The PHP Foundation says a developer working for it spotted the first signs in 2024, during PHP's first outside security check in years, but no one found a concrete way to attack it. Work on a fix stalled and restarted for months. The foundation calls the delay a structural failure, caused by how its security team made decisions and too few resources. Reports from Calif, OpenAI and the security firm Wiz from August on made the full danger clear. The flaws' official ID numbers then leaked online on Oct. 20, though no technical details did, the foundation says, and PHP moved its release forward a day. Calif then mistakenly posted a video, since deleted, that revealed a few limited details, the foundation adds.
OpenAI calls the flaws one of the most serious security problems in recent memory, and warns that the AI that can find such flaws can also help attackers quickly build tools to use them. It expects similar findings to rise sharply in the coming months, and says it has committed $1 billion in subsidized access to its Daybreak security tools for organizations that protect essential services but have little security help. The PHP Foundation says tools now find bugs faster than ever, for defenders and attackers alike, while deciding on the right fix still takes experienced engineers who know PHP inside out, and there are too few of them.
None of the agencies or companies has said whether attackers have broken into any servers. Amazon says it is unclear how the attacker it saw on Oct. 17 got the details before they were public, or whether the early attempts would have worked on real systems.