AI tools uncover critical PHP vulnerabilities, prompting urgent patching

Key facts

• Two critical vulnerabilities in PHP were discovered using AI tools.
• The flaws allow attackers to execute their own code on servers.
• PHP powers approximately 70% of websites globally.
• OpenAI and Wiz independently found the vulnerabilities.
• PHP has released patches for the flaws.
• The NSA advised taking unpatched websites offline.

OpenAI's AI models were instrumental in discovering critical vulnerabilities in the PHP programming language, which powers approximately 70% of the world's websites. OpenAI President Greg Brockman announced that his company led a two-month coalition, utilizing its AI models, to address the PHP2Shell bug. Security firm Calif used GPT-5.6 Sol to find a version of the flaw in August, and OpenAI's own team identified a more complete version in September. Cloud security firm Wiz also found both vulnerabilities independently. The flaws allow attackers to execute their own code on vulnerable servers. PHP has released patches for the issues, but the U.S. National Security Agency has advised that websites unable to be patched immediately should be taken offline.