OpenAI Model Finds Critical PHP Flaws, Triggering Urgent Website Updates

Business Insider reports that cybersecurity researchers using OpenAI models found exploits in PHP, a widely used open-source programming language. OpenAI said 70% of the world's websites could be in peril, and the National Security Administration's cyber division advised web providers using PHP to take systems offline or update their software.

The reported issue centers on two "critical" flaws in PHP's infrastructure. OpenAI said the vulnerabilities appeared to have been identified before attackers discovered them, but the disclosure triggered a race to patch systems before hackers could exploit the bugs.

PHP often powers behind-the-scenes website functions, including user logins and online orders. OpenAI President Greg Brockman said in an X post that hackers could exploit the vulnerability to steal private user data or modify websites.

Numerous websites, including government and media sites, went offline Wednesday to address the issue, according to the report. For operators, the clear takeaway is to verify PHP exposure immediately and apply available fixes or mitigations.

The critical flaw was first identified by Calif, a cybersecurity research company using GPT-5.6 Sol, according to Business Insider. Wiz independently uncovered the issues, OpenAI said.

Both companies are part of OpenAI's "Patch the Planet" initiative, which aims to improve the security of digital infrastructure. The discovery highlights how AI models may speed up vulnerability research—and how quickly defenders must respond after disclosure.

OpenAI warned that more security failures may emerge as researchers continue probing software with frontier models. A Microsoft engineer, Nicolas Bustamante, said on X that the PHP vulnerability was discovered with an older model and added: "I don't think the world is prepared for the sheer number of vulnerabilities newer models will uncover."

Cloudflare CTO Dane Knecht said on X that early attacks were emerging and mitigations were being updated as new vectors appeared. The practical takeaway: security teams should treat AI-assisted vulnerability discovery as an ongoing operational risk, not a one-time incident.