NSA Cyber division urges organizations to patch security flaws identified by AI

The National Security Agency's Cyber division warned organizations Wednesday to update systems that use the programming language PHP as soon as possible after it detected security flaws in the code. 

OpenAI President Greg Brockman said the errors in the code have been around for 14 years and a version of the flaw was deemed insignificant in 2024. 

The warning comes as PHP is used in 70% of all websites globally, including platforms like WordPress and Wikipedia’s MediaWiki.

“Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities,” the NSA wrote in a post on X. “These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommended organizations take the system offline until it can be fully mitigated.”

Brockman said the latest version of the bug was detected in August and that OpenAI has been leading a coalition to "mitigate one of the most severe bugs in open source software found in recent memory."

“This vulnerability allows any attacker to execute code on nearly all deployed PHP application, effectively allowing them to exfiltrate private user data or modifying the site however they want,” he added in a post on X.

The FBI has also urged users and companies to update systems using PHP and to look for “signs of compromise” and report them to a local FBI field office or the Internet Crime Complaint Center.

Misty Severi is a news reporter for Just The News. You can follow her on X for more coverage.