PHP patches critical flaws found with AI by OpenAI and Wiz
By Automate Basics, written with AI from TechCrunch's original
The PHP Foundation has issued patches for two critical flaws found through AI-assisted security research, TechCrunch reports. Businesses running PHP websites, including WordPress sites, need to check whether their servers have been updated.
What changed
The PHP Foundation has issued patches for two critical security flaws in PHP, according to TechCrunch. PHP runs many websites and is used by content management systems including WordPress. The flaws could let an attacker reach a website server’s files or a database used by its application.
TechCrunch reports that security researchers working with OpenAI found one flaw using AI, while Google’s Wiz team used AI tools to identify vulnerabilities in PHP. The researchers worked with PHP on fixes before making their findings public. OpenAI says there had been no reports of attackers exploiting the flaws when they were disclosed. The U.S. National Security Agency has advised taking an affected website offline if it cannot be patched promptly.
Who needs the PHP patches?
Anyone responsible for a PHP website should check its server, including businesses whose sites run on WordPress. TechCrunch reports that WordPress says these are not WordPress-specific flaws: site owners need to address the PHP installation on the server and work with their hosting company if the host manages it.
TechCrunch says the flaws have been present since PHP 5. It identifies PHP 8.5.12 as the current version recommended for an update and notes that PHP 8.1 and older versions are no longer supported. The report does not give a price for the patches, describe paid plans or say which hosting companies have already applied them. A business using managed hosting should therefore confirm its own server’s status rather than assume a WordPress update covers the problem.
How do I check a work website?
A useful first task is to ask whoever maintains your website or hosting account which PHP version the server runs and whether the security patches have been applied. For a WordPress site, check with the hosting company if it manages PHP updates. TechCrunch reports that the recommended current version is PHP 8.5.12; a site on an unsupported older version may need more update work.
After an update, ask the person responsible for the site to check that its usual pages and work tasks still function. Confirm the server was patched, rather than treating a working website as proof that it is safe. If the site cannot be patched promptly, the National Security Agency’s guidance, as reported by TechCrunch, is to take it offline until it can be.
Frequently asked questions
Does updating WordPress fix the PHP flaws?
Not by itself, according to the WordPress statement reported by TechCrunch. The flaws affect PHP on the server, not WordPress specifically. If your hosting company manages the server, ask it whether the PHP installation has been patched.
Have attackers used these PHP flaws?
OpenAI says there were no reports of the flaws being exploited when they were disclosed, according to TechCrunch. That does not remove the need to patch: the flaws are now public, and the National Security Agency advises taking a site offline if it cannot be patched promptly.
For you
Learn to do this with AI, free
Short courses for people who aren't engineers: ChatGPT, Claude, prompting and automation. Every lesson is free, with no card.
Start a free courseFor companies
Make an AI or automation tool?
List it in the directory for $9.99, refunded in full if it isn't approved, or claim its page if it is already here.
Related reading
Google brings conversational Gemini navigation to Apple CarPlayGoogle has brought conversational Gemini navigation to Google Maps on Apple CarPlay. US drivers can ask about places, follow up with directions and report traffic disruptions by voice, according to The Verge.
Anthropic introduces Claude Duet agent for daily workAnthropic has announced Claude Duet, an AI agent for professionals and small business owners that can monitor connected apps and carry out work tasks. The Verge reports that it is launching as a research preview with a waitlist.
Walmart will let shoppers use AI agents to make purchasesWalmart plans to allow AI agents to shop on its site next month, The Verge reports. Shoppers will be able to approve purchases, set spending limits and review agent orders separately from their own.
Written with AI from TechCrunch's original and published after automatic checks: every figure here appears in the original, and no sentence is copied from it. The picture is AI-generated. The original is the authority.
Get the next one by email
One email, most weeks: what changed in AI for people who use it at work, and what to do about it.
Source: PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet, TechCrunch, 21 Oct 2026.