OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon Identify Critical PHP Vulnerability Affecting Millions of Websites

What happened

AI models from OpenAI and Google found a critical PHP vulnerability that could affect millions of websites worldwide. OpenAI's GPT-5.6 Sol tracked down the flaw as part of the Patch-the-Planet initiative, which OpenAI calls one of the "most impactful security issues in recent memory." The model spotted the vulnerabilities before attackers did, giving developers and security vendors a window to respond.

Security firm Wiz independently found the same flaws, using its own Wiz Atlas platform alongside Google's Gemini 4 Argon and GPT-5.6 Sol.

Key details

• A tool on GitHub now lets server operators check whether their PHP version is affected.
• According to Wiz, Gemini 4 Argon proved especially useful for finding the vulnerability, developing exploits, building attack detection, and validating the patch.
• The fix was coordinated over two months across five phases, involving PHP developers, Wiz, Cloudflare, and US agencies including CISA and the White House.
• OpenAI is proposing this process as a repeatable framework for future AI-driven security discoveries.
• Exploits that worked against one specific PHP installation used to require significant effort to adapt to other versions and configurations; large language models can automatically adjust exploits across different PHP versions, configurations, and memory layouts. Wiz writes that this "significantly lowers the barrier to scaling attacks across different deployments," and that vulnerabilities that "once seemed impractical to exploit" become viable targets.

Why it matters

OpenAI expects findings on the scale of the PHP2Shell flaw to "increase sharply in the coming months," but warns that the same AI capabilities that find vulnerabilities can help attackers too. The discovery feeds into a months-long debate over AI models' offensive and defensive cybersecurity capabilities. The incident is a concrete example of AI's dual nature: it gave defenders an early window to respond while also significantly lowering the barrier to scaling attacks.

Who it affects

Websites and server operators running PHP are directly affected and can use the GitHub tool to check whether their PHP version is vulnerable. Security vendors, developers, and the parties involved in the coordinated fix—Cloudflare, CISA, and other US agencies—are also directly involved.

AI models from OpenAI and Google found a critical PHP vulnerability that could affect millions of websites worldwide.

GPT-5.6 Sol tracked down the flaw as part of the Patch-the-Planet initiative, which OpenAI calls one of the "most impactful security issues in recent memory." The model spotted the vulnerabilities before attackers did, giving developers and security vendors a window to respond. A tool on GitHub now lets server operators check whether their PHP version is affected.

Security firm Wiz found the same flaws independently, using its own Wiz Atlas platform alongside Google's Gemini 4 Argon and GPT-5.6 Sol. Gemini 4 Argon proved especially useful for finding the vulnerability, developing exploits, building attack detection, and validating the patch, according to Wiz.

AI lowers the bar for attackers

An exploit that worked against one specific PHP installation used to require significant effort to adapt to other versions and configurations, Wiz explains. Large language models remove that barrier because they can automatically adjust exploits across different PHP versions, configurations, and memory layouts. "This significantly lowers the barrier to scaling attacks across different deployments," the firm writes, adding that "vulnerabilities that once seemed impractical to exploit become viable targets."

The fix was coordinated over two months across five phases, involving PHP developers, Wiz, Cloudflare, and US agencies including CISA and the White House. OpenAI is proposing this process as a repeatable framework for future AI-driven security discoveries.

The company expects findings on the scale of the PHP2Shell flaw to "increase sharply in the coming months," but warns that the same AI capabilities that find vulnerabilities can help attackers too. The discovery feeds into a months-long debate over AI models' offensive and defensive cybersecurity capabilities.

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.

Subscribe now

The original belongs to The Decoder and its authors and is reproduced here for reading. To have it removed, write to support@aisa.one.