PHP's creators disclose a critical memory-management vulnerability, dubbed “PHP2Shell”, that affects up to 70% of websites, discovered via GPT-5.6 Sol in August
AI tools helped find one of the most severe online bugs ever. Cyber experts are racing to patch it before hackers use AI to exploit it.
Context & Ripple Effects
The PHP development team had flagged two 9.2-rated flaws a day earlier, then issued security fixes for unauthenticated RCE vulnerabilities affecting web request-serving installations. Cloudflare says it put default WAF mitigations in place for its customers before disclosure, creating an immediate but partial defensive buffer.
The disclosure also puts OpenAI’s account that GPT-5.6 Sol found the flaws alongside a broader claim that AI-assisted vulnerability findings may increase sharply. The consequence is not merely a PHP patch cycle: it is a test of whether defenders can validate, disclose, and deploy mitigations as quickly as AI-assisted research expands the supply of serious findings.
First-order effects
- PHP site operators must identify exposed request-serving installations and apply the released fixes; unpatched deployments face the disclosed unauthenticated remote-code-execution risk.
- Cloudflare customers receive default WAF mitigation for the two flaws, while PHP users outside that protection must rely on their own patching and compensating controls.
Second-order effects
- Cloudflare’s mitigation gives hosting and security teams time to patch, but it also makes accurate asset inventories and version management the operational bottleneck for PHP-dependent organizations.
- OpenAI’s disclosure raises the bar for PHP maintainers and other software projects to triage AI-assisted reports quickly enough that fixes and protective rules are ready at publication.
Third-order effects
- If OpenAI’s expectation of sharply rising AI-found vulnerabilities holds, coordinated disclosure will shift toward shorter intervals between discovery, patch release, and perimeter mitigation—an instance of AI-assisted security research scaling vulnerability discovery.
- The same code-intelligence capabilities that surface severe defects will intensify the dual-use pressure around PHP remote-code-execution findings, making patch adoption speed a more important security differentiator than discovery alone.
The trend: AI-assisted code analysis is compressing the vulnerability-discovery cycle, forcing maintainers, cloud providers, and software users to synchronize remediation faster.