Critical PHP Security Flaws Uncovered by OpenAI AI Models

OpenAI Models Uncover Critical PHP Vulnerabilities

OpenAI announced on Wednesday that its AI models helped uncover critical security flaws in PHP that are currently forcing websites across the internet to scramble for patches. The company stated that it spent the past two months leading a coalition of PHP maintainers, security researchers, and security companies to address the vulnerabilities, which have been nicknamed PHP2SHELL.

The newly exposed flaws could allow attackers to take over servers running PHP, a programming language that powers a substantial share of the web. OpenAI characterized the bugs as one of the most impactful security problems in recent memory. In a separate Wednesday blog post, the PHP foundation thanked OpenAI alongside other industry partners and cybersecurity researchers for their collaborative response.

How the Coalition Discovered and Handled the PHP2SHELL Flaws

As part of Patch the Planet, an OpenAI security program, the company reported that security firm Calif located one of the severe vulnerabilities using the GPT-5.6 Sol model. Security company Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers led the work on the fixes, while OpenAI, Wiz, Cloudflare, and other partners contributed research and helped prepare protections before public disclosure.

OpenAI President Greg Brockman shared additional context in a post on X, noting that PHP was the first programming language he learned. Brockman stated that the bug had existed in PHP for 14 years, with a smaller version having been found in 2024 that was not treated as serious at the time. Calif discovered a version of the bug in August, and OpenAI’s internal team independently found a more complete version in September.

The coalition originally planned to disclose the flaws on October 22, according to Brockman, but details leaked early, prompting PHP’s maintainers to release fixes a day ahead of schedule. Brockman noted that the two-month preparation window remained vital because the fixes were complicated and an earlier leak could have caused significantly more damage. In addition, OpenAI aligned its countermeasures alongside U.S. government entities, including the Cybersecurity and Infrastructure Security Agency, the Office of the National Cyber Director, and the White House’s Super Intelligence Force.

Immediate Outages and Global Response Across the Web

The patch deployment caused visible disruption across the internet. Wikipedia went down on Wednesday morning, and the Wikimedia Foundation confirmed to Mashable that the outage was tied directly to the PHP vulnerabilities, adding that it took other systems offline as a precaution until they could be safely patched. Downdetector logs showed other popular platforms experiencing service interruptions, including Asana, GOG, Duolingo, Capital One, Bitbucket, Moodle, Quest Diagnostics, Final Fantasy XIV, War Thunder, and the Internet Archive, though most did not formally confirm a connection to the PHP flaw.

International leadership also mobilized in response to the emergency. Japan’s prime minister issued a public appeal on X urging website operators to check whether their public platforms utilized PHP and to install the patch immediately upon its release at 11 p.m. Japan time on October 21, coinciding with PHP’s 10 a.m. Eastern Time release. Regular internet users were not required to take personal action, as mitigation relies entirely on server administrators applying the released patches.

The Shift Toward Automated Vulnerability Discovery

OpenAI stated that PHP will likely not be the final case of its kind, noting that its systems have already uncovered several other serious vulnerabilities and anticipating a sharp rise in similar discoveries over the coming months. Brockman pointed to a separate remote code execution flaw disclosed by Node.js on Wednesday as part of the rapid security scrutiny facing the technology sector.

The rapid rise of AI models like GPT-5.6-Sol and Claude Mythos in discovering zero-day vulnerabilities has strained traditional bug disclosure frameworks, prompting some initiatives to shut down entirely, as Mashable reported previously. Brockman described current bug-handling methods as slow and manual, arguing they will not scale as AI capabilities advance. To address this, OpenAI has asked the security community for feedback on a new disclosure coordination process, including proposals for authorized defenders or governments to continuously scan the internet for vulnerable systems, warn site owners, and potentially patch them directly in extreme cases.

Recognizing the dual-use risk that the same AI capabilities could help malicious actors accelerate exploit development, OpenAI committed $1 billion toward subsidized access to its security tools for organizations protecting essential services. The company is also releasing a diagnostic utility to help site operators verify whether their systems are running a vulnerable version of PHP.

Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.

More on this story: PHP vulnerability leads to website shutdowns for emergency patching · Amazon and AI Expert Warn of Rapid PHP2Shell Cyber Attacks

More on AI Models: Vanderbilt Researchers: China's Open-Weight AI Models Pose Risks