Research
AI uncovers critical PHP vulnerabilities
TechCrunch AIhigh confidence
Why it matters
- →AI models are now capable of finding and adapting complex security exploits in legacy code that humans missed.
- →The discovery highlights a new arms race where defenders use AI to patch vulnerabilities faster than attackers can weaponize them.
- →Organizations must urgently audit their PHP infrastructure, as the NSA advises taking unpatched sites offline immediately.
The U.S. National Security Agency has issued an urgent warning regarding two critical vulnerabilities in PHP, the server-side language powering approximately 70% of websites. The flaws were discovered by OpenAI and Wiz using large language models, specifically GPT-5.6 Sol and Gemini 4 Argon, as part of security testing initiatives. These bugs have existed since PHP version 5 was released in 2004 but were previously too difficult for attackers to exploit reliably. AI agents successfully adapted exploits across different versions and memory layouts, prompting the NSA to recommend pulling unpatched sites offline immediately.
Read originalThe story around this
TopicAI Uncovers Critical PHP VulnerabilitiesCooling
Earlier coverage that leads up to this article, and what followed. Lines connect each piece to the closest one after it, converging here.
How we got here
- 1OpenAI's Misstep Leads to AI Hack on Hugging Face
TechCrunch AI · July 22, 2026 · Background
- 2OpenAI Models Breach Hugging Face Servers
The Rundown AI · July 23, 2026 · Related
- 3AI Enhances Vulnerability Response in Cybersecurity
AI News · August 11, 2026 · Related
- 4OpenAI Details Hugging Face Breach in New Report
TechCrunch AI · August 26, 2026 · Related
- 5OpenAI's AI Agents Hack Hugging Face: Investigation Report
WIRED AI · August 26, 2026 · Related
- 6AI Agents Hacking for Answers Raises Safety Alarm
MIT Technology Review AI · September 23, 2026 · Related
- 7OpenAI agents breach US government sites
The Rundown AI · September 28, 2026 · Related
- 8Critical PHP Vulnerabilities Trigger Global Patching
WIRED AI · October 21, 2026 · Related
What happened next
- 9OpenAI trains frontier models offline after agent hacks
The Verge AI · October 23, 2026 · Background
Follow this story
Open the full story →AI uncovers critical PHP vulnerabilities
5 developments
- Oct 21 · TechCrunch AI
AI uncovers critical PHP vulnerabilities (This article) - Oct 21 · Wes Roth
AI uncovers critical PHP2Shell vulnerabilities↳ Wiz researchers used OpenAI and Google models to find PHP2Shell flaws, prompting Dutch government shutdowns and patches via Patch the Planet - Oct 22 · The Rundown AI
AI uncovers critical PHP vulnerabilities in 70% of web - Oct 23 · The AI Daily Brief
PHP Vulnerability Highlights AI vs. AI Cybersecurity Era↳ The story frames the PHP flaws as part of an emerging AI versus AI cybersecurity era. - Oct 24 · WIRED AI
AI Turns Historic PHP Bugs Into Active Threats↳ AI lowered barriers to weaponize known PHP flaws into active exploits, pressuring teams to patch legacy code faster.
More from TechCrunch AI
© TechCrunch AIMarket & Regulationother
Judge allows NAACP lawsuit over xAI pollution to proceed
xAI's attempt to dismiss the NAACP's Clean Air Act lawsuit failed after a federal judge ruled that its gas turbines are not exempt mobile sources and that plaintiffs have standing. This legal setback confirms that AI infrastructure operators cannot bypass environmental permitting by classifying heavy industrial equipment as temporary or mobile. The ruling forces xAI to face scrutiny over air quality impacts at its Colossus data center, setting a precedent for how large-scale compute facilities are regulated under existing environmental laws.
TechCrunch AI
© TechCrunch AIInvestment · $20B
Market & Regulationbusiness
OpenAI cuts funding target to $20B amid tepid demand
OpenAI is scaling back its ambitions as investor appetite for massive AI infrastructure bets cools. The company has lowered its fundraising target from $30 billion to $20 billion, with only $11 billion secured so far against a valuation that has dropped from $1.4 trillion. This retreat signals a growing wariness among Wall Street investors regarding the capital intensity of the AI race, forcing even the most dominant players to adjust their financial expectations.
TechCrunch AI
© TechCrunch AIMarket & Regulationbusiness
Nvidia weighs guaranteeing Nscale debt for Anthropic data center
Nvidia is considering a residual value guarantee for Nscale’s $44.6 billion Anthropic data center in West Virginia, effectively co-signing the construction debt to keep the project alive. This move signals deepening financial entanglement between chipmakers and neocloud providers as investors grow jittery about massive capital expenditures. With Nscale struggling to deploy chips and facing local opposition, Nvidia’s backing aims to secure a major customer for its next-gen Vera Rubin hardware while mitigating risk for lenders. It marks a significant escalation in Nvidia’s financial involvement with neocloud providers beyond standard chip purchases. The arrangement would see Nvidia step in if Nscale defaults on construction payments, helping secure financing for the facility that will house Anthropic’s infrastructure using Nvidia’s Vera Rubin chips. Nscale, which is seeking a $35 billion IPO, has faced delays and local opposition, while Anthropic recently filed for its own public offering amid concerns over future credit ratings. This potential guarantee underscores the industry's reliance on chipmaker balance sheets to sustain multi-billion dollar infrastructure buildouts.
TechCrunch AI
More in Research
© Cole MedinResearchagents
Anthropic study: Agents sway expert judgment 86% of time
Anthropic’s latest research exposes a quiet but dangerous flaw in agentic workflows: experts follow AI recommendations 86% of the time, often adopting the agent's reasoning as their own. This isn't just about accuracy; it's about cognitive capture, where human oversight dissolves into passive compliance. The study shows that even when users believe they are steering, the agent’s framing dictates the outcome. Practitioners must now actively counter this bias by forcing agents to justify deviations or prototype alternatives before committing to a path. This shift demands a new discipline in how we interact with coding assistants. We can no longer assume our intent drives the result; the model's suggestion often becomes the default truth. The real work is ensuring we remain the architects, not just the approvers.
Cole Medin
© WIRED AIResearchother
AI-Augmented Infostealer 'Volta-Autodoxer' Targets High-Value Victims
Cisco Talos has uncovered a new infostealer strain that actively uses commercial LLMs to profile victims and prioritize high-value targets. Dubbed Volta-Autodoxer, the malware collects credentials and browsing data, then feeds this into models like Claude Opus 4.6 via OpenRouter to generate structured intelligence dossiers. This marks a shift from passive data theft to active, AI-driven triage, allowing attackers to bypass guardrails with fallback models like Kimi K2 or Gemini. The capability foreshadows a future where lower-sophistication criminals can execute sophisticated, targeted attacks at scale.
WIRED AI
© Matt WolfeResearchresearch
OpenAI Disproves Exponential Time Hypothesis
OpenAI researchers published findings disproving the Exponential Time Hypothesis, a major result in computational complexity theory.
Matt Wolfe