OpenAI Mobilizes Tech Firms to Fix Widespread Web Vulnerability
OpenAI led a two-month effort to fix what the company called “one of the most impactful security issues in recent memory.” OpenAI shared the news in a blog post on Wednesday, October 21.
The effort focused on serious security weaknesses in PHP, a free, open-source programming language used to run websites and web applications.
The weaknesses were independently discovered and reported by Calif and Wiz. PHP's maintainers then worked with OpenAI, Wiz, Cloudflare and other groups to prepare protections before making the weaknesses public, the post said.
Organizations that use PHP are now installing the fixes, according to the post.
OpenAI's GPT-5.6 Sol helped Calif find the weaknesses. OpenAI also shared a PHP version as a Codex skill. This tool helps operators identify PHP versions that may be at risk and find out which updates they need, according to the post.
“Given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI said in the post. “It shows that AI can find security weaknesses that affect websites across the internet. But these same abilities can also help attackers quickly build tools and exploits to carry out attacks.”
“To our knowledge, advanced AI found these weaknesses before attackers did. This gave maintainers and security providers time to prepare fixes and protections before the weaknesses were made public,” OpenAI said.
Wiz said in a blog post on Wednesday that its research team had found several security weaknesses in PHP. Wiz said PHP powers 70% of the world's websites. If attackers successfully used these weaknesses, they could take control of affected servers, steal sensitive data and change the appearance of the websites running on them.
PHP released a patch on Wednesday, according to the post.
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” Wiz said. “The weaknesses had existed for decades, but showing that attackers could use them required an extremely complicated series of steps. These steps were very difficult for human researchers to carry out in practice. Advanced AI models greatly reduced this difficulty, turning a long-standing weakness into a working exploit.”
Cloudflare said in a blog post on Wednesday that it developed protections against these weaknesses and put them in place about nine hours before the weaknesses were made public.