Story perspectives

NSA Warns Immediate Patching of High-Severity PHP Flaws

By Drooid · Oct 23, 2026, 6:17 AM UTC · How we work

Summary

Story summary

The U.S. NSA warned organizations to patch PHP flaws immediately after AI discovery.
Wiz and Calif used Gemini 4 Argon and GPT-5.6 Sol AI models to find two PHP flaws.
The PHP Foundation issued emergency updates 8.5.12, 8.4.27, 8.3.36, and 8.2.35 rating flaws 9.2/10.
The FBI urged sites unable to patch immediately to go offline to block remote code execution.

History

Historical Context

The 2024 alert on AI-found buffer-read flaws echoes the 2014 Heartbleed crisis in OpenSSL, where a 2012-introduced bug was disclosed on 7 April 2014 and left roughly 17 % of TLS-enabled sites vulnerable. Both episodes show how out-of-bounds reads trigger rapid, coordinated patch drives across major software ecosystems. The 2024 CrowdStrike-related outage, also caused by an out-of-bounds read, reinforces the pattern.

1 of 2

Story summary

The U.S. NSA warned organizations to patch PHP flaws immediately after AI discovery.
Wiz and Calif used Gemini 4 Argon and GPT-5.6 Sol AI models to find two PHP flaws.
The PHP Foundation issued emergency updates 8.5.12, 8.4.27, 8.3.36, and 8.2.35 rating flaws 9.2/10.
The FBI urged sites unable to patch immediately to go offline to block remote code execution.

1 / 2