OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon found critical PHP flaw affecting millions of websites
AI models from OpenAI and Google found a serious security flaw in PHP, a programming language used by millions of websites around the world.
OpenAI's GPT-5.6 Sol found the flaw through the Patch-the-Planet initiative. OpenAI describes it as one of the "most impactful security issues in recent memory." The AI model found the flaws before attackers did, giving developers and security companies time to respond. A tool on GitHub now lets server operators check whether their PHP version is affected.
The security company Wiz also found the same flaws independently. It used its own Wiz Atlas platform along with Google's Gemini 4 Argon and GPT-5.6 Sol. According to Wiz, Gemini 4 Argon was especially helpful in finding the flaw, creating ways to exploit it, building systems to detect attacks, and checking that the fix worked.
AI makes attacks easier for more people
Wiz explains that an attack that worked on one particular PHP setup once took a lot of work to adapt to other versions and settings. Large language models can remove this difficulty by automatically adjusting attacks to work with different PHP versions, settings, and memory layouts. Wiz writes that this "significantly lowers the barrier to scaling attacks across different deployments." The company adds that "vulnerabilities that once seemed impractical to exploit become viable targets." In other words, weaknesses that were once too difficult to use in an attack may become easier to exploit on many systems.
The teams coordinated the fix over two months in five stages. The work involved PHP developers, Wiz, Cloudflare, and US government organizations, including CISA and the White House. OpenAI is presenting this process as a model that could be used again when AI helps discover security flaws in the future.
OpenAI expects discoveries as serious as the PHP2Shell flaw to "increase sharply in the coming months." But the company warns that AI tools that help find security flaws can also help attackers. This discovery adds to a debate that has lasted for months about how AI models can be used both to attack computer systems and to protect them.