NSA Urges Organizations to Patch “Catastrophic” Flaws in PHP Code

The U.S. National Security Agency (NSA) advised organizations using the PHP language on Wednesday, Oct. 21, to prepare for an update addressing two critical vulnerabilities discovered by artificial intelligence (AI), according to an agency advisory.

The Federal Bureau of Investigation‘s (FBI) Cyber Division separately urged organizations to act quickly and users to monitor for suspicious activity ^[1]. The FBI told users to report signs of compromise to a local field office or the Internet Crime Complaint Center ^[1]. The bureau’s advice followed the NSA’s warning that the holes are so severe that if a website is not patched, attackers could take control of or disrupt websites and access sensitive user information ^[7].

PHP is a server-side programming language used to create dynamic web pages and is widely deployed across web applications ^[2]. By some accounts, it powers roughly 70% of the websites on the internet, or more than 33 million sites, and is used by popular content management systems like WordPress ^[3].

Agencies Issue Warnings as PHP Developers Release Fixes

The NSA warning was issued Wednesday morning, according to the agency’s post on X ^[4]. PHP developers released fixes Wednesday morning and urged users to update immediately, the project said ^[3]. Government websites in Europe and elsewhere went dark before the fixes were released, according to reports ^[5].

The British government said it was working to actively identify and patch any potential exposure in its online services, after vulnerabilities were identified in the PHP programming language that underpins a significant number of the world’s websites ^[6]. Governments and some of the world’s biggest companies, including Amazon, were scrambling to protect their systems before hackers could exploit them ^[6].

Flaw Present for 14 Years, OpenAI Says

OpenAI President Greg Brockman said the bug identified by security researchers has been present in the code for 14 years ^[8]. A limited version of the bug was initially discovered in 2024 but was not deemed significant, he said ^[8]. In August, researchers working with an OpenAI initiative and using GPT-5.6 Sol found a version of the vulnerability, he noted ^[3].

Brockman said OpenAI has led a coalition over the past two months to mitigate one of the most severe open-source software bugs found in recent memory ^[3]. He added the vulnerability allows an attacker to execute code on nearly all deployed PHP applications, potentially exfiltrating private user data or modifying sites ^[3].

Researchers at cybersecurity company Wiz wrote in a blog post Wednesday that the findings rank among the most severe vulnerabilities discovered in PHP and arguably in malware history ^[3]. The flaws were first discovered by AI, after which governments and agencies urged websites to update ^[6].

The discovery highlights how technical debt, described as the gradual buildup of confusing, disorganized or buggy code in an application, can accumulate over years if development time is not set aside to refactor ^[9]. Security guidance for web technologies stresses that administrators must keep their knowledge updated and constantly read available documentation, because web technologies are always changing ^[10].

AI Tools Cited for Speed and Dual-Use Risk

AI developers have said the technology can spot security vulnerabilities at significantly faster rates than humans or traditional computer systems ^[11]. The same developers have warned that the tools can also be employed by bad actors, according to industry statements ^[11]. OpenAI released a PHP version checker within its Codex system to help operators identify potentially vulnerable PHP versions ^[3].

The discovery adds to an ongoing debate over the security implications of AI-assisted vulnerability research. Some independent technology commentators have argued that centralized systems concentrate risk and that open-source alternatives can enhance security and transparency while giving users greater sovereignty over their technology use ^[12].

References

1. FBI Issues Advice As Security Issue Hits Global Websites. https://www.newsweek.com/fbi-issues-advice-as-security-issue-hits-global-websites-12603155
2. Collaborative Tokamak Control Room Development within the National Fusion Collaboratory Project. by Elsevier. Journal of Magnetic Fusion Energy 2006
3. PHP armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet. https://techcrunch.com/2026/10/21/php-armageddon-openai-googles-wiz-find-ancient-holes-panicking-the-internet/
4. NSA warns organizations to patch security flaws identified by AI. https://thehill.com/policy/technology/6163568-nsa-warns-php-security-flaws/
5. The internet is having a very bad cybersecurity day. https://techcrunch.com/2026/10/21/the-internet-is-having-a-very-bad-cybersecurity-day/
6. UK working to identify exposure after global cyber-security warning. https://bbc.com/news/articles/cmx23d0k57d3o
7. Critical security flaw puts most websites at risk as NSA issues warning. https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates–live/92362348007/
8. NSA Cyber division urges organizations to patch security flaws. https://justthenews.com/government/security/nsa-cyber-division-urges-organizations-patch-security-flaws-identified-ai
9. Your First Year in Code by Isaac Lyman
10. Hardening Apache. by introduces many of the security problems you
11. The Scramble to Tackle AI National Security Risks. https://theepochtimes.com/article/the-scramble-to-tackle-ai-national-security-risks-6054286
12. Mike Adams interview with Zach Vorhies – July 22, 2024, by Mike Adams

Explainer Infographic