OpenAI's GPT-5.6 Sol model found PHP flaws affecting millions of servers in days

What happened

Cybersecurity firm Calif used OpenAI's flagship GPT-5.6 Sol model to find two critical vulnerabilities in PHP, the software that underpins roughly 70 percent of websites. That puts millions of sites in the blast radius.

The flaws are present in PHP versions dating back to 2004. Working under OpenAI's "Patch the Planet" program, the Calif team found them in just days and reported them to the PHP Foundation on August 11. Google-owned security firm Wiz independently discovered the same flaws and filed its report on August 24.

Impact

Wiz called them among the "most severe vulnerabilities discovered in PHP, and arguably in software history." After the news broke, Wikipedia, Steam and some government sites briefly went dark. Organizations that cannot quickly apply Wednesday's patch remain exposed until they do.

The US National Security Agency advised a drastic fallback for those who cannot patch: keep the site offline and do not turn it back on.

The debate

The speed with which AI surfaced the flaws has intensified debate over AI's role in security. Details leaked a day before the scheduled disclosure, complicating the coordinated release. OpenAI is expected to present the find as proof of its model's capability, while experts note that AI is shifting the balance on both the defensive and offensive sides.