AI models found a critical PHP flaw that could affect millions of websites

AI models from OpenAI and Google helped identify a critical PHP vulnerability that could affect millions of websites worldwide. OpenAI’s GPT-5.6 Sol found the flaw through the Patch-the-Planet initiative, while security firm Wiz independently found the same issue using its Wiz Atlas platform alongside Google’s Gemini 4 Argon and GPT-5.6 Sol.

The Decoder reports that OpenAI described the issue as one of the most impactful security issues in recent memory. A GitHub tool is available for server operators to check whether their PHP version is affected.

The key concern is scale. According to Wiz, large language models can help adapt exploits across PHP versions, configurations, and memory layouts, reducing work that previously required significant manual effort.

That makes AI useful for defenders who need to find, test, and validate patches quickly. It also raises risk because the same capabilities can help attackers make vulnerabilities practical across more deployments.

The fix was coordinated over two months and five phases. The process involved PHP developers, Wiz, Cloudflare, and US agencies including CISA and the White House.

OpenAI is presenting the process as a possible repeatable framework for future AI-driven security discoveries. The broader takeaway for operators is clear: AI-assisted discovery may shorten the time between vulnerability discovery, patch validation, and public risk.

OpenAI expects findings on the scale of the PHP2Shell flaw to increase sharply in the coming months. That points to a cybersecurity landscape where AI systems help uncover major flaws faster, but also force defenders to assume attackers may gain similar acceleration.

For website and server teams, the practical priority is to verify exposure, track PHP security updates, and treat AI-discovered vulnerabilities as urgent operational events rather than distant research findings.