What happened
According to The Decoder, OpenAI's model GPT-5.6 Sol found a critical security flaw in PHP as part of the Patch-the-Planet initiative. According to the report, OpenAI calls the finding one of the most impactful security issues in recent memory. According to TechCrunch, the security firm Wiz independently found the flaws using Wiz Atlas, Google's Gemini 4 Argon and also GPT-5.6 Sol. According to Wiz, Gemini 4 Argon was especially useful for finding the vulnerability, developing exploits, building attack detection and validating the patch.
Scope
TechCrunch reports that the US National Security Agency has issued a warning about two critical PHP flaws for which the PHP Foundation has already released patches. According to TechCrunch, PHP runs roughly 70 percent of websites on the internet, by some accounts more than 33 million sites. The flaws are said to exist in all PHP versions since version 5 (2004). The NSA advises taking websites offline if they cannot be patched immediately.
A new risk from AI
According to The Decoder, Wiz explains that an exploit that worked against one specific PHP installation previously had to be laboriously adapted to other versions and configurations. Wiz says large language models remove this barrier because they can automatically adapt exploits to different PHP versions, configurations and memory layouts. According to The Decoder, OpenAI expects findings of this scale to increase sharply in the coming months and warns that the same capabilities can also help attackers.
Coordinated response
According to The Decoder, the fix was coordinated over two months in five phases, involving PHP developers, Wiz, Cloudflare and US agencies including CISA and the White House. OpenAI proposes this process as a repeatable framework for future AI-driven security discoveries. According to TechCrunch, there are so far no reports of exploits in the wild.
Assessment
If you operate websites using PHP, it may be worth checking your PHP version. According to TechCrunch, the NSA recommends updating to the current version, currently 8.5.12, because PHP 8.1 and older versions are no longer supported. According to The Decoder, OpenAI provides a tool on GitHub that lets operators check whether their version is affected. It remains open how quickly operators will actually patch their systems before attacks become possible.
Sources
Editorially owned by Ideal Syka. Sources and method: Newsroom & method. Tips and corrections: ai@i6eal.de.
