PHP's creators disclose a critical memory-management vulnerability, dubbed “PHP2Shell”, that affects up to 70% of websites, discovered via GPT-5.6 Sol in August
AI tools helped find one of the most severe online bugs ever. Cyber experts are racing to patch it before hackers use AI to exploit it.
Context & Ripple Effects
The disclosure follows confirmation of two unauthenticated RCE flaws across web-serving PHP deployments. The remediation gap is uneven: the PHP Foundation's official fixes cover PHP 8.2 and newer, leaving older installations reliant on third-party vendors.
OpenAI characterizes the PHP findings as part of a wider set of significant vulnerabilities found with GPT-5.6 Sol and expects comparable findings to increase. That makes the episode a test of whether patch distribution can keep pace with machine-assisted code auditing.
First-order effects
- PHP operators must prioritize patching and exposure checks for unauthenticated code-execution paths; operators on pre-8.2 releases depend on vendor-supplied remediation.
- Hosting providers and software vendors supporting legacy PHP deployments become immediate choke points because they control the fixes unavailable from the PHP Foundation.
Second-order effects
- The legacy-support burden shifts security urgency from individual site owners to the vendors and managed hosts that package, test, and distribute PHP updates.
- OpenAI's expectation of more significant AI-found flaws raises the volume of findings that security teams must validate, prioritize, and patch, increasing the value of faster disclosure-to-deployment workflows.
Third-order effects
- If machine-assisted discovery produces severe flaws faster than maintainers can patch old versions, software ecosystems will face sharper pressure to retire unsupported deployments rather than extend legacy support indefinitely.
- The incident points toward a dual-use code-intelligence market in which the same AI capability accelerates defensive auditing while reducing the effort required to identify high-impact attack paths.
The trend: AI-assisted code analysis is compressing the time between vulnerability discovery and remediation, exposing legacy software support as a security bottleneck.