Millions Of Websites At Risk Of Hacking As OpenAI's GPT-5.6 Sol Finds Critical PHP Flaws

In a recent cybersecurity incident that could put millions of websites at risk, OpenAI said on Wednesday that its AI model, GPT-5.6 Sol, had found a serious security flaw in PHP. PHP is a programming language used to run millions of websites around the world. The discovery has raised concerns about the safety of websites and online services because hackers may be able to use these weaknesses to gain access to affected systems.

The company, led by Sam Altman, explained that a researcher named Calif found the flaw as part of its Patch the Planet initiative. Cybersecurity company Wiz also independently found and reported two security flaws affecting PHP. OpenAI said it had worked with PHP developers, security researchers, and technology companies, including Wiz and Cloudflare, over the previous two months to help fix the problems before sharing the details publicly.

AI technology can help security experts find weaknesses in software, but OpenAI has warned that the same technology could also be used to carry out cyberattacks. The company believes this could create a new challenge for cybersecurity teams. OpenAI has also warned that researchers may find more security flaws, as the PHP issues are not the only major problems its researchers have discovered.

OpenAI expects the number of similar discoveries to increase in the coming months as AI models become better at checking software and finding weaknesses. The company has also promised $1 billion in discounted access to its Daybreak AI tools through an initiative called Daybreak for Frontline Defenders.

OpenAI is also offering a tool that checks PHP versions. It helps website operators find possible security flaws in vulnerable software and work out which security updates they need.

The issue is considered very serious. NSA Cyber, a division of the US National Security Agency, advised all organisations that use PHP in their systems to prepare to install an update that fixes two critical security flaws. It said, “PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.”