OpenAI says the PHP flaws, found using GPT-5.6 Sol, “are among several significant vulnerabilities” it found and expects “similar findings to increase sharply”
Check a website: — node phpcheck.js “https://example.com” — Check the local CLI PHPJulie Bort /TechCrunch:PHP Armageddon: OpenAI, Google's Wiz find ancient holes, panicking the internetMatteo Wong /The Atlantic:Read This Website While You Still CanEmily Forlini /Fortune:AI tools discovered the PHP vulnerability that could take down 70% of the Internet. Now the race is on to patch it before AI-powered hackers attackBrian Krebs /Krebs on Security:Widespread PHP Flaw May Cause Many Site Outages
Remediation is uneven: the PHP Foundation says its fixes are limited to PHP 8.2 and newer, leaving older installations reliant on vendors. That echoes the durability of patch-management risk seen in an earlier PHP fix that researchers said could be bypassed.
First-order effects
PHP operators and security teams must identify exposed deployments, apply available updates, and use the supplied checking workflow to assess affected sites.
Legacy PHP users face a different response path from users of supported releases because their remediation depends on third-party vendor support.
Second-order effects
Hosting providers, managed-service firms, and software vendors supporting older PHP versions face heightened demand for patch guidance and upgrade assistance.
OpenAI's release of a checking skill gives defenders a reusable model-assisted assessment tool, while the same class of code-analysis capability raises the value of coordinated disclosure and rapid patch validation.
Third-order effects
If frontier models continue finding significant flaws at the pace OpenAI anticipates, software security will shift toward continuous model-assisted auditing rather than vulnerability discovery led primarily by periodic human review.
The gap between supported and legacy runtimes becomes a larger internet-resilience issue: widely deployed open-source infrastructure needs maintainers, vendors, and operators to coordinate fixes across uneven upgrade cycles.
The trend: AI code intelligence is becoming dual-use security infrastructure, compressing the time between finding systemic software defects and the need to remediate them.
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, a…
If you are wondering whether your website is affected, we have packaged a Codex skill to help check. Point your Codex at this repo to guide you through it: https://github.com/...
“Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.” https://cloud.google.com/... [embedded post]
php2shell is the most consequential vulnerability I have ever helped discover. I am proud of how our team worked closely in coordination with the PHP Foundation to provide support and to harden the patch in preparation for this release. Please read more about our approach:
Companies I talk to are struggling with the rate of patches they need to do thanks to AI defenses finding issues before the inevitable wave of incoming cyberattacks by other AIs. Now consumers are going to have the same experience of getting everything updated often & fast.
Credit to @OpenAI @wiz_io @ThePHPF for finding php2shell and running a responsible, coordinated disclosure. This won't be the last one. Models will keep finding bugs like this in software everyone runs. Maintainers, researchers, providers and governments need a new shared playboo…
Disclosure of vulnerabilities is no longer the right model. It's a blacklist model. It assumes default security. The right model is a whitelist model. All code with potential security risks has to come with an AI redteaming certificate. Anything that's not like an XML file [embed…
The PHP incident is more evidence that we're heading toward a new paradigm for existing on the internet. It feels like the future will have much more digital surveillance. [image] [embedded post]
People don't realize this critical PHP vulnerability was found using GPT-5.6 Sol. We've already moved on to GPT-6 Astra and GPT-6.1. This is what older models can do. I don't think the world is prepared for the sheer number of vulnerabilities newer models will uncover, or the cyb…
Kind of fascinating that both Google and OpenAI are claiming credit for their AI tools discovering (apparently independently) the massive, scary PHP vulnerability that is taking down sites across the internet today. — cloud.google.com/blog/product... openai.com/index/coordi...
HugOps to EVERYONE who has deployed PHP 🤞 php2shell is “One of the most severe bugs in open source software found in recent memory” according to Greg Brokman [embedded post]
It's striking that this vulnerability was found by Sol and Argon rather than being found and fixed in the wake of Mythos 6mo ago. Seems like a heavy strike against the “defense will run ahead of offense” theory, especially give that domains like bio are much harsher than cyber.