NSA Sends Emergency Warning to Websites. The Flaws Behind It Were Found by AI.

The two PHP flaws behind Wednesday's warning were found and turned into working attacks by researchers using OpenAI and Google models. Attackers started probing for them before the patch was out.

Researchers at Calif, OpenAI and Wiz used frontier models to prove that a PHP memory bug first spotted in 2020 could hand an attacker full control of a web server. The coordinated fix was planned for Thursday. A leak pushed it to Wednesday, and Cloudflare saw attacks before it shipped.

The National Security Agency told every organization running PHP on Wednesday to install an emergency update or take its systems offline until it can. In an advisory, NSA's cybersecurity directorate said the two flaws "often provide a direct path to the server's file system or database" and promised more specific guidance.

PHP is the server-side language under WordPress, Drupal, Magento and a long tail of internal company sites. The flaws, which researchers have named PHP2Shell, let an attacker take over a server with one crafted web request and no login. PHP shipped fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. CISA said it had not seen exploitation when it published its alert. Several security firms said they had.

What the NSA didn't say

The NSA's advisory doesn't mention AI. The researchers who found the flaws talk about little else.

One of the two bugs wasn't new. A weakness in how PHP handles running out of memory was reported in 2020 and flagged again in a 2024 audit, SecurityWeek reported. Both times it was left alone because nobody could prove an attacker could use it. This summer, researchers working with OpenAI and Google models proved it in a matter of weeks and turned it into a way to take over almost any PHP server.

That changes the math for enterprise security teams. Plenty of known bugs have sat in backlogs because showing they were exploitable took weeks of expert work. AI is making that work cheap, and it's cheap for attackers too. Every old bug report marked theoretical is now worth a second look.

What the flaws do

PHP rated both flaws 9.2 out of 10 on the CVSS v4 scale. CVE-2026-109618 hits when PHP runs out of memory partway through a request. The request data is left half built, and PHP's cleanup code treats it as valid anyway. The same bug can leak chunks of server memory, which can include passwords and API keys. CVE-2026-109619 lets PHP keep pointing at memory it has already freed after a fatal error.

The PHP project says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, according to Help Net Security. Researchers say vulnerable versions go back to PHP 5.4, and Sansec reported confirmed attacks against Magento and ten other PHP applications. Because the bugs sit in PHP itself, a site's own code can be clean and still be exposed.

Teams on end-of-life branches (8.1, 8.0 and 7.4) got source code backports only and will be waiting on their operating system vendor or host. The PHP Foundation published temporary workarounds, but says they cut off specific attack paths without making a server safe. Cloudflare pushed emergency firewall rules to every plan, free accounts included, and its CTO called them a stopgap. They only help if the origin server refuses traffic that doesn't come through Cloudflare.

How the researchers found it

Calif, working through OpenAI's Patch the Planet program, found the first exploitable path on August 1 using GPT-5.6 Sol and reported it to PHP on August 11. OpenAI's Codex Security team reported the same issue that day. Wiz, which Google owns, independently found its first flaw on August 19, using its own Atlas tool with Gemini 4 Argon and GPT-5.6 Sol, according to GIGAZINE.

Wiz said proving the flaws exploitable took a chain of steps "at the edge of what human researchers could practically achieve." It also wrote that one researcher with frontier models did in a week what used to take a top team months.

PHP2Shell is the latest in a run of AI-found bugs in software nearly everyone depends on. The PHP Foundation says AI has helped surface 15 new PHP vulnerabilities since July 1. In July, Searchlight Cyber used GPT-5.6 Sol to find a WordPress core exploit chain called wp2shell, and attackers were planting webshells soon after it went public. Anthropic says its Project Glasswing has identified more than 10,000 high- or critical-severity vulnerabilities. We've covered what that looks like on the receiving end: Bank of America hired 1,000 contractors to patch flaws found by Anthropic's Mythos.

Wiz also says the two CVEs cover four memory-safety issues and that other variants probably exist, some not yet tracked.

Ten weeks of head start, gone in a day

OpenAI calls the stretch between an AI finding a bug and the public fix the "Defender's Window." In its disclosure post, it says that to its knowledge, AI found these flaws before attackers did.

The window ran about ten weeks. Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, Vercel and others used it to prepare guidance and temporary protections, and Cloudflare had firewall rules live nine hours before disclosure.

The last 24 hours went badly. On October 20, a Hacker News post revealed the CVE numbers ahead of the planned October 22 disclosure, Infosecurity Magazine reported, and a demo video went up early. The PHP Foundation moved the release to 14:00 UTC on October 21. At 07:43 UTC that morning, Cloudflare reported the first attacks. Six hours before release, Chainguard shipped patched builds it had received in advance, which the PHP Foundation said let any attacker study the fix while other PHP users were still waiting.

How many of those attacks worked is still unclear. Hadrian said it saw exploitation at scale. watchTowr saw attempts around the time the patches landed and no successes. Huntress had seen none across its customers as of Wednesday morning. So far the reports describe attempted attacks, and no one has publicly confirmed a mass compromise.

Our read

The Defender's Window held for ten weeks and failed in its final 24 hours. Coordinated disclosure at this scale meant dozens of companies held the details early so they could protect customers, and each of them was a possible leak. AI-assisted research will keep producing bugs in software everyone runs, which means more embargoes like this one, with more parties in them.

Enterprise security and engineering teams should plan for that pace. Emergency patches to a core runtime used to be rare. Teams need to know where PHP and other shared runtimes are running before the next advisory, including inside vendor products they don't manage, and who can approve an emergency change on short notice.

Keep the sources in mind, too. The widely cited figure that PHP runs 70% of websites is an estimate of PHP's share of sites, not a count of exposed servers. Wiz is owned by Google and credits Gemini, and OpenAI is promoting its own security program. Their accounts line up with the PHP Foundation's, and they are also good marketing.

What to watch

The first signal is CISA's Known Exploited Vulnerabilities catalog. The two CVEs weren't on it as of Wednesday, and an addition would mean confirmed successful attacks in the wild.

Next are the variants Wiz says are still untracked. If they turn out to be exploitable, PHP users could face another emergency release soon.

Last is evidence of how the attackers built their exploits. No report so far has shown attackers using AI here. The PHP Foundation says the early demo video helped speed up public exploit development.