OpenAI says the PHP flaws, found using GPT-5.6 Sol, “are among several significant vulnerabilities” it found and expects “similar findings to increase sharply”
Check a website: — node phpcheck.js “https://example.com” — Check the local CLI PHPJulie Bort /TechCrunch:PHP Armageddon: OpenAI, Google's Wiz find ancient holes, panicking the internetMatteo Wong /The Atlantic:Read This Website While You Still CanEmily Forlini /Fortune:AI tools discovered the PHP vulnerability that could take down 70% of the Internet. Now the race is on to patch it before AI-powered hackers attackBrian Krebs /Krebs on Security:Widespread PHP Flaw May Cause Many Site Outages
Remediation is uneven: the PHP Foundation says its fixes are limited to PHP 8.2 and newer, leaving older installations reliant on vendors. That echoes the durability of patch-management risk seen in an earlier PHP fix that researchers said could be bypassed.
First-order effects
PHP operators and security teams must identify exposed deployments, apply available updates, and use the supplied checking workflow to assess affected sites.
Legacy PHP users face a different response path from users of supported releases because their remediation depends on third-party vendor support.
Second-order effects
Hosting providers, managed-service firms, and software vendors supporting older PHP versions face heightened demand for patch guidance and upgrade assistance.
OpenAI's release of a checking skill gives defenders a reusable model-assisted assessment tool, while the same class of code-analysis capability raises the value of coordinated disclosure and rapid patch validation.
Third-order effects
If frontier models continue finding significant flaws at the pace OpenAI anticipates, software security will shift toward continuous model-assisted auditing rather than vulnerability discovery led primarily by periodic human review.
The gap between supported and legacy runtimes becomes a larger internet-resilience issue: widely deployed open-source infrastructure needs maintainers, vendors, and operators to coordinate fixes across uneven upgrade cycles.
The trend: AI code intelligence is becoming dual-use security infrastructure, compressing the time between finding systemic software defects and the need to remediate them.
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, a…
@gdb
@gdb on x
Towards securing the internet
@openai
@openai on x
If you are wondering whether your website is affected, we have packaged a Codex skill to help check. Point your Codex at this repo to guide you through it: https://github.com/...
@rseroter
Richard Seroter on x
“Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.” https://cloud.google.com/... [embedded post]
@eric_wallace_
Eric Wallace on x
Similar to our results on math, we have been using internal frontier models to find …
@itszn13
@itszn13 on x
php2shell is the most consequential vulnerability I have ever helped discover. I am proud of how our team worked closely in coordination with the PHP Foundation to provide support and to harden the patch in preparation for this release. Please read more about our approach:
@emollick
Ethan Mollick on x
Companies I talk to are struggling with the rate of patches they need to do thanks to AI defenses finding issues before the inevitable wave of incoming cyberattacks by other AIs. Now consumers are going to have the same experience of getting everything updated often & fast.
@ashleyrgold
Ashley Gold on x
OAI says they collaborated with the Trump admin's Super Intelligence Force on this [embedded post]
@andrewcurran_
Andrew Curran on x
OpenAI says the PHP security flaw (found with GPT-5.6 Sol) is the tip of the iceberg, and they have several more discoveries to announce.
@peterwildeford
Peter Wildeford on x
AI systems found a working server takeover exploit in PHP, one of the most critical cybersecurity issues in recent memory! …
@dok2001
Dane Knecht on x
Credit to @OpenAI @wiz_io @ThePHPF for finding php2shell and running a responsible, coordinated disclosure. This won't be the last one. Models will keep finding bugs like this in software everyone runs. Maintainers, researchers, providers and governments need a new shared playboo…
@derrickcchoi
Derrick Choi on x
Our models found critical vulnerabilities in PHP
@davewiner
Dave Winer on x
PHP is an important foundation of the early web, and it must be preserved.
@autismcapital
@autismcapital on x
Apparently there's a patch for the critical PHP vulnerabilities but a few things that are alarming. …
@curtis_yarvin
Curtis Yarvin on x
Disclosure of vulnerabilities is no longer the right model. It's a blacklist model. It assumes default security. The right model is a whitelist model. All code with potential security risks has to come with an AI redteaming certificate. Anything that's not like an XML file [embed…
@steipete
Peter Steinberger on x
That PHP vulnerability that's gonna cause havoc this week was found with... GPT-5.6 Sol.
@m_adams
Michael Adams on x
The PHP incident is more evidence that we're heading toward a new paradigm for existing on the internet. It feels like the future will have much more digital surveillance. [image] [embedded post]
@nicbstme
Nicolas Bustamante on x
People don't realize this critical PHP vulnerability was found using GPT-5.6 Sol. We've already moved on to GPT-6 Astra and GPT-6.1. This is what older models can do. I don't think the world is prepared for the sheer number of vulnerabilities newer models will uncover, or the cyb…
@timkellogg.me
Mr. Tim on bluesky
openai has a skill to check for the PHP 0day — github.com/openai/php2s...
@masnick.com
Mike Masnick on bluesky
Kind of fascinating that both Google and OpenAI are claiming credit for their AI tools discovering (apparently independently) the massive, scary PHP vulnerability that is taking down sites across the internet today. — cloud.google.com/blog/product... openai.com/index/coordi...
r/programiranje
r on reddit
OpenAI našao kritičan vulnerability u PHPu, 70% interneta pogodjeno
r/technology
r on reddit
The AI-Hacking Apocalypse Began Last Night
@altryne
Alex Volkov on x
HugOps to EVERYONE who has deployed PHP 🤞 php2shell is “One of the most severe bugs in open source software found in recent memory” according to Greg Brokman [embedded post]
@so8res
Nate Soares on x
It's striking that this vulnerability was found by Sol and Argon rather than being found and fixed in the wake of Mythos 6mo ago. Seems like a heavy strike against the “defense will run ahead of offense” theory, especially give that domains like bio are much harsher than cyber.
@alper
@alper on x
I'm guessing the exploit leaked because so many people were working on marketing materials around this incident. [embedded post]