NSA urges PHP sites offline as 14-year-old bug is found with a five-word AI prompt
nicolechirps · x · 2026-10-23
The NSA issued an emergency advisory telling organizations using PHP to prepare for updates addressing two critical vulnerabilities—direct paths to the server's filesystem or database—or take systems offline. The flaw sat in the code powering 70% of websites for 14 years. Chainguard CEO Dan Lorenc found it in one evening with a five-word prompt ("find bad vulnerabilities in PHP"); Calif had found it earlier using OpenAI's GPT-5.6 Sol, and Google-acquired Wiz independently found it with Gemini and GPT. OpenAI, Wiz, Calif and PHP maintainers have since quietly coordinated a fix.
More from AGI Musings
- Economist Beraja: AI isn't a Napster moment—frontier tech legitimizes taking after the fact — danielrock · 2026-10-23
- Casey Newton and Kevin Roose publish manifesto for 'AI realism' at Machine Gods — kevinroose · 2026-10-23
- CS PhD production up 71.6% since 2015 while humanities degrees fall 20% — plopesresearch · 2026-10-23
- Ex-OpenAI science head Kevin Weil: US must use AI and robotics to win back pharma before it's too late — beffjezos · 2026-10-23
- dhh's Tech Summit speech on AI and Omarchy: 'I'm morally obligated to deliver antidotes to despair' — zealcaiden · 2026-10-23
- "AI will add to GDP for like 6 months tops" — consultant's provocative AGI take — danfaggella · 2026-10-23