AI Models Find Critical PHP Flaw Affecting Millions of Websites
OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon independently uncovered the same critical PHP vulnerability, which security firm Wiz confirmed. OpenAI warns that the same AI capabilities could also aid attackers.
OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon have each independently discovered a critical vulnerability in the widely used PHP programming language, a flaw that could affect millions of websites. The finding, made as part of OpenAI's Patch the Planet initiative, was independently corroborated by security firm Wiz, which used Gemini 4 Argon to identify the same weakness.
The dual discovery marks a notable moment for AI-assisted security research: two separate large language models, developed by competing companies, arrived at the same critical flaw without coordination. The fact that Wiz reproduced the result using a different model lends weight to the finding and suggests that AI tools are becoming capable of systematic vulnerability detection at scale.
PHP remains one of the most common server-side languages powering the web, used by major content management systems and countless smaller sites. A critical flaw in the language itself, rather than in a single application, would therefore have an unusually broad reach. Details of the vulnerability's technical nature and the exact conditions required for exploitation have not been fully disclosed, but the involvement of a major security firm and two leading AI models indicates the issue is being treated seriously.
OpenAI has cautioned that the same capabilities that allow AI models to find vulnerabilities can also be turned toward malicious ends. Attackers could use similar tools to scan for weaknesses faster and more thoroughly than human researchers alone, potentially shortening the window between the discovery of a flaw and its exploitation. That warning echoes long-standing concerns in the security community about the dual-use nature of increasingly capable AI systems.
The Patch the Planet initiative appears designed to direct AI capabilities toward defensive security work, identifying flaws before they can be exploited. The collaboration between OpenAI's model and Wiz's use of Gemini 4 Argon suggests a growing role for AI in the early stages of vulnerability research, where automated scanning can cover far more code than manual review.
For organizations running PHP-based websites, the discovery is a reminder that language-level vulnerabilities can sit beneath the layers of application code and third-party plugins that usually receive the most attention. Patching depends on the maintainers of PHP itself releasing a fix, after which site operators must update their server environments promptly. The timeline for a fix and the precise scope of affected versions have not been detailed.
The episode also raises questions about how vulnerability disclosures will work when AI models are among the discoverers. Coordinated disclosure practices assume human researchers who can be contacted and who agree to timelines; AI-assisted findings add new participants and new speed to that process. How OpenAI, Google, and security firms like Wiz manage those disclosures will shape how quickly defenders can respond.
For now, the confirmed facts are narrow: two AI models found the same critical PHP flaw, a security firm verified it, and OpenAI has publicly warned that the technology cuts both ways. The broader significance lies in what the discovery suggests about the coming era of automated security research, in which finding flaws may become faster and cheaper, and the race to patch them correspondingly more urgent.
8
