OpenAI says GPT-5.6-Sol helped find the PHP flaws now shaking the internet

OpenAI says its AI models helped find serious security flaws in PHP. These flaws are forcing websites across the internet to rush to protect their systems.

In a blog post published on Wednesday, OpenAI said it had spent the past two months leading a group of PHP maintainers, security researchers, and security companies to deal with the flaws. The flaws are now known by the nickname "PHP2SHELL." In its own blog post on Wednesday, the PHP Foundation thanked OpenAI, along with other industry partners and cybersecurity researchers.

The newly discovered flaws could let attackers take control of servers that run PHP, a programming language used by a large part of the web. OpenAI called these bugs one of the most serious security problems in recent memory.

OpenAI said the security company Calif found one of the serious flaws using its GPT-5.6 Sol model as part of an OpenAI security program called Patch the Planet. Security company Wiz also found and reported both flaws independently, OpenAI said. The people who maintain PHP led the work to fix them. OpenAI, Wiz, Cloudflare, and other partners researched the flaws and helped prepare protections before the details became public.

OpenAI President Greg Brockman shared more details in a post on X. He said PHP was the first programming language he learned, so he had a personal connection to this work.

Brockman said the bug had existed in PHP for 14 years. A less serious version of the bug was found in 2024, but it was not seen as a major threat at the time. Calif found a version of the bug in August, and OpenAI's own team independently found a more complete version in September.

Brockman said the group planned to reveal the flaws on Oct. 22, but details leaked early, so PHP's maintainers released the fixes one day ahead of schedule. He said the two months spent preparing were still important because the fixes were complicated. If the details had leaked earlier, the damage could have been much worse.

OpenAI said it also worked with U.S. government agencies to respond. These included the White House's Super Intelligence Force, the Office of the National Cyber Director, and the Cybersecurity and Infrastructure Security Agency.

OpenAI says this will not be the last case of its kind. The company said it has already found several other serious security flaws and expects the number of similar discoveries to rise sharply in the coming months. Brockman also pointed to a separate flaw that lets attackers run code on a remote system. Node.js, another widely used web technology, announced this flaw on Wednesday.

This year, new AI models such as GPT-5.6-Sol and Claude Mythos have helped cause a rapid increase in the number of software bugs being found. As Mashable reported earlier, this has led some programs that help people find and report previously unknown security flaws, called zero-day bugs, to shut down completely.

Brockman wrote that the current way of dealing with bugs like these is "slow and manual." He said this approach will not work well as AI gets better at finding security flaws. OpenAI is asking security experts for feedback on a new way to coordinate the reporting of these problems. One idea is for governments or other authorized defenders to keep scanning the internet for systems with security flaws. They could warn website owners when they find a problem and, in extreme cases, fix the systems themselves.

OpenAI also recognizes the risks of this idea. The same AI abilities that helped find these flaws could help attackers create ways to exploit them more quickly. To give defenders better access to these tools, the company says it has committed $1 billion to provide its security tools at lower prices for organizations that protect essential services. It is also releasing a tool that helps website operators check whether they are using a vulnerable version of PHP.

Meanwhile, the internet is having a week

The rush to install fixes has been easy to see. Wikipedia went offline on Wednesday morning, and the Wikimedia Foundation confirmed to Mashable that the outage was linked to the PHP flaws. The foundation said it had also taken other systems offline as a safety measure until they could be safely updated.

Other popular websites have also stopped working or posted notices about maintenance. According to Downdetector, services having problems during the PHP incident include Asana, GOG, Duolingo, Capital One, Bitbucket, Moodle, Quest Diagnostics, Final Fantasy XIV, War Thunder, and the Internet Archive. Most have not said whether their problems are related to PHP. However, PHP is used across much of the internet.

Leaders in other countries are also responding, beyond the U.S. government's cybersecurity teams. Japan's prime minister made an unusual public appeal on X, urging people who run websites to take action that night, according to a translation of her post in Japanese.

The prime minister asked website owners to check whether their public websites use PHP and install the fix as soon as it became available at 11 p.m. Japan time on Oct. 21. This was the same time as PHP's release at 10 a.m. Eastern Time.

For most people, the effects should be limited to some websites being temporarily unavailable. Ordinary users do not need to install anything because the companies that run the websites are responsible for applying the fix.

Disclosure: Ziff Davis, the company that owns Mashable, filed a lawsuit against OpenAI in April 2025. The lawsuit claims that OpenAI infringed Ziff Davis's copyrights when training and running its AI systems.