OpenAI says the PHP flaws, found using GPT-5.6 Sol, “are among several significant vulnerabilities” it found and expects “similar findings to increase sharply”
- Validate and fix the upstream vulnerability. … - Give affected organizations time to act.
Context & Ripple Effects
OpenAI had already paired its GPT-5.5-Cyber release with Patch the Planet, an open-source bug-fixing initiative; the PHP findings put that detection-and-remediation model against widely deployed web infrastructure. PHP’s maintainers had scheduled fixes for two 9.2-rated flaws, while the PHP2Shell disclosure indicated the issue’s broad exposure.
First-order effects
- PHP maintainers and organizations running web-serving PHP deployments must validate the upstream fixes and deploy patches for the two critical unauthenticated RCE vulnerabilities.
- OpenAI’s disclosure process moves GPT-5.6 Sol from a security-research claim to a concrete source of significant findings that vendors must coordinate and remediate.
Second-order effects
- Security teams face a larger triage and patch-validation workload as OpenAI expects similar AI-assisted findings to increase sharply, making remediation capacity a constraint alongside detection.
- Open-source maintainers working with AI-assisted researchers will need coordinated disclosure windows that give downstream operators time to apply fixes before details spread.
Third-order effects
- If AI-assisted discovery scales faster than organizations can test and deploy fixes, software security will be shaped by a verification bottleneck: finding flaws becomes cheaper than establishing safe remediation.
- The Patch the Planet approach points toward security programs that pair automated vulnerability discovery with funded or organized upstream repair, rather than treating disclosure as the endpoint.
The trend: AI code intelligence is accelerating vulnerability discovery, shifting the limiting factor in open-source security toward coordinated verification and patch deployment.
Related: Dual-use code intelligence · Verification bottleneck · PHP · OpenAI · PHP2Shell vulnerability disclosure · OpenAI’s Patch the Planet initiative
Related Coverage
- ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire Wired
- Hundreds of websites taken offline as concern grows over two PHP vulnerabilities The Record · Jonathan Greig
- A report claims exploit tool PHP2Shell enables RCE on PHP sites; watchTowr says two vulnerabilities affect every version since PHP 5, which was released in 2004 Ars Technica · Dan Goodin
- AI Finds Flaw in Popular Web Hosting Software, Sparking Global Race to Patch The Information · Aaron Holmes
- PHP urges immediate patching as details of two critical flaws reportedly leak Metacurity · Cynthia B Brumfield
- Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619 Sansec
- PHP developers issue new version to fix critical vulnerabilities Reuters · Kanjyik Ghosh
- What's Happening — On 2026-10-21T07:00:00Z, PHP published an advisory about two critical vulnerabilities in PHP. IFIN
- Websites go offline after critical security glitch Telegraph
- Finland temporarily shuts down government websites as a precaution for critical vulnerabilities Yle News
- Impact of PHP vulnerabilities on Wikimedia tools and services Diff
- Critical flaws strike PHP as disclosure embargo is broken iTnews · Juha Saarinen
- ‘We expect mass attacks to start within 15 minutes of the release’: Web admins braced for emergency PHP updates to plug leaked high-severity holes PC Gamer · Andy Edser
- Patch the Planet: global response coordination as agents uncover vulnerabilities Hacker News
- Widespread PHP Flaw May Cause Many Site Outages Today Krebs on Security · Brian Krebs
- OpenAI Says AI Found One Of The Biggest Web Weaknesses Ever Forbes · Thomas Brewster
- AI helped find a critical security flaw affecting 70% of the internet CNN · Lisa Eadicicco
- Run directly — Check a website: — node phpcheck.js “https://example.com” — Check the local CLI PHP GitHub
- Critical PHP vulnerabilities expose vast majority of websites to potential compromise Cybersecurity Dive · Eric Geller
- US, allies warn of critical vulnerabilities in programming underlying 70% of the internet Politico
- PHP Releases Emergency Fixes for Critical PHP2Shell Vulnerabilities Hackread · Waqas
- It's ‘One of the Most Impactful Security Issues in Recent Memory’ Newser · Kate Seamons
- PHP armageddon: OpenAI, Google's Wiz find ancient holes, panicking the internet TechCrunch · Julie Bort
- Urgent security fix issued for code vital to estimated 70% of all websites ABC7 · Matthew Glasser
- OpenAI helps uncover critical PHP vulnerabilities affecting millions of websites Crypto Briefing · Diego Almada Lopez
- US agencies urge fixes for programming language flaws putting millions of web systems at risk FCW · David DiMolfetta
- OpenAI: AI Discovers Critical PHP Vulnerabilities Blockchain.News
- Who Found the PHP Bug That Made Governments Unplug Their Websites? ChatGPT, Of Course Decrypt · Jose Antonio Lanz
- Flaw in PHP computer language leads to shutdown of websites around world The Guardian
- AI tools discovered the PHP vulnerability that could take down 70% of the Internet. Now the race is on to patch it before AI-powered hackers attack Fortune · Emily Forlini
- Patch the Planet expands coordinated disclosure for critical open source bugs Blockchain.News · Caroline Bishop
- OpenAI says GPT-5.6-Sol helped find the PHP flaws now shaking the internet Mashable · Chance Townsend
- Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 Google Cloud Blog
- The AI-Hacking Apocalypse Began Last Night The Atlantic · Matteo Wong
- OpenAI Mobilizes Tech Firms to Fix Widespread Web Vulnerability PYMNTS.com
- PHP Patches Two Critical RCE Flaws Found with Frontier AI Models Unite.AI · Miles Okada
- OpenAI Wants to ‘Patch the Planet’ (With Its Own AI) Gizmodo · Webb Wright
- PHP: The three letters that shut down sites all over the internet today The Verge
- AI Helped Find a Critical Bug Affecting Huge Swathes of the Internet Mother Jones · Satchel Walton
- Canadian organizations urged to address web programming vulnerability Globe and Mail · Alexandra Posadzki
- OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon found critical PHP flaw affecting millions of websites The Decoder · Matthias Bastian
- AI found flaws in the code behind 70% of the web. The fix took two months. The New Stack · Amanda Caswell
- Inside Critical PHP Vulnerabilities That Have 70% Of The Internet At Risk Inc42
Discussion
-
@dok2001
Dane Knecht
on x
Credit to @OpenAI @wiz_io @ThePHPF for finding php2shell and running a responsible, coordinated disclosure. This won't be the last one. Models will keep finding bugs like this in software everyone runs. Maintainers, researchers, providers and governments need a new shared playboo…
-
@emollick
Ethan Mollick
on x
Companies I talk to are struggling with the rate of patches they need to do thanks to AI defenses finding issues before the inevitable wave of incoming cyberattacks by other AIs. Now consumers are going to have the same experience of getting everything updated often & fast.
-
@davewiner
Dave Winer
on x
PHP is an important foundation of the early web, and it must be preserved.
-
@andrewcurran_
Andrew Curran
on x
OpenAI says the PHP security flaw (found with GPT-5.6 Sol) is the tip of the iceberg, and they have several more discoveries to announce.
-
@steipete
Peter Steinberger
on x
That PHP vulnerability that's gonna cause havoc this week was found with... GPT-5.6 Sol.
-
@derrickcchoi
Derrick Choi
on x
Our models found critical vulnerabilities in PHP
-
@itszn13
@itszn13
on x
php2shell is the most consequential vulnerability I have ever helped discover. I am proud of how our team worked closely in coordination with the PHP Foundation to provide support and to harden the patch in preparation for this release. Please read more about our approach:
-
@openai
@openai
on x
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, a…
-
@ericjgeller.com
Eric Geller
on bluesky
OpenAI, whose model helped researchers discover the vulnerabilities: “Given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory.” openai.com/index/coordi...
-
@gdb
@gdb
on x
Towards securing the internet
-
r/accelerate
r
on reddit
“OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP …
-
@openai
@openai
on x
If you are wondering whether your website is affected, we have packaged a Codex skill to help check. Point your Codex at this repo to guide you through it: https://github.com/...
-
@peterwildeford
Peter Wildeford
on x
AI systems found a working server takeover exploit in PHP, one of the most critical cybersecurity issues in recent memory! …
-
@nicbstme
Nicolas Bustamante
on x
People don't realize this critical PHP vulnerability was found using GPT-5.6 Sol. We've already moved on to GPT-6 Astra and GPT-6.1. This is what older models can do. I don't think the world is prepared for the sheer number of vulnerabilities newer models will uncover, or the cyb…
-
@eric_wallace_
Eric Wallace
on x
Similar to our results on math, we have been using internal frontier models to find …
-
r/technology
r
on reddit
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
-
r/singularity
r
on reddit
Patch the Planet: global response coordination as agents uncover critical vulnerabilities
-
@so8res
Nate Soares
on x
It's striking that this vulnerability was found by Sol and Argon rather than being found and fixed in the wake of Mythos 6mo ago. Seems like a heavy strike against the “defense will run ahead of offense
-
@masnick.com
Mike Masnick
on bluesky
Kind of fascinating that both Google and OpenAI are claiming credit for their AI tools discovering (apparently independently) the massive, scary PHP vulnerability that is taking down sites across the internet today. — cloud.google.com/blog/product... openai.com/index/coordi...
-
@lookitup.baby
Ian Coldwater
on bluesky
Oh for actual f's sake. If you're going to drop catastrophic 0days that leak before anyone is able to patch them at least have the decency not to brag about giving defenders time to prepare [image]
-
@curtis_yarvin
Curtis Yarvin
on x
Disclosure of vulnerabilities is no longer the right model. It's a blacklist model. It assumes default security. The right model is a whitelist model. All code with potential security risks has to come with an AI redteaming certificate. Anything that's not like an XML file [embed…
-
@rseroter
Richard Seroter
on x
“Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.” https://cloud.google.com/... [embedded post]
-
@jamesomalley.co.uk
James O'Malley
on bluesky
Jesus. OpenAI says ChatGPT found a major security flaw in PHP, which runs a significant part of the web. — (And it found it using GPT 5.6, so not even the latest model.) — openai.com/index/coordi...
-
r/programiranje
r
on reddit
OpenAI našao kritičan vulnerability u PHPu, 70% interneta pogodjeno
-
r/technology
r
on reddit
The AI-Hacking Apocalypse Began Last Night