OpenAI model flags critical PHP flaw; urgent patches live

An OpenAI model discovered a critical security vulnerability in PHP, the programming language powering WordPress and an estimated 70 percent of websites, according to OpenAI and The Rundown AI.

Discovery and Impact

Security firm Calif used GPT-5.6 Sol to analyze PHP code and identified a flaw that could allow attackers to take over servers without authentication. Wiz independently found the same issues. OpenAI described the vulnerability as one of the most impactful in recent memory due to PHP's widespread use.

Response and Coordination

OpenAI led a two-month coordinated effort under its Patch the Planet initiative involving PHP maintainers, Wiz, and Cloudflare to develop fixes. Patches were released after details leaked early. The National Security Agency advised organizations unable to update immediately to take affected systems offline.

AI Role in Security

This case demonstrates AI's ability to identify internet-scale vulnerabilities ahead of attackers, creating a defender's window for preparation, as noted in OpenAI's statement.