AI-Found PHP Flaws Send the Web Scrambling to Patch

Found before attackers, OpenAI says.

OpenAI says its models helped researchers in its Patch the Planet initiative discover critical security flaws in PHP. It estimates the open-source programming language runs 70% of websites. @TheRundownAI calls PHP the language behind WordPress and nearly 70% of websites.

Over the past two months, OpenAI says, it led a coalition of maintainers, researchers and security providers to prepare fixes and protections ahead of disclosure. The fix required a major change to the PHP engine. Every site using PHP can now safely upgrade, it says, in addition to applying mitigations from security vendors.

OpenAI considers it “one of the most impactful vulnerabilities in recent memory,” and says it marks a new phase, where AI can find security bugs with internet-scale impact. It calls this the Defender’s Window in action: “to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.”

Calif, Wiz and a leak.

Security firm Calif pointed GPT-5.6 Sol at PHP’s code, @TheRundownAI reports, and it found a critical flaw that could let attackers take over a server without logging in. Wiz found the same bugs independently. OpenAI then coordinated the response with PHP’s maintainers, Wiz and Cloudflare.

Patches dropped this morning after details leaked early, @TheRundownAI says, but any server that hasn’t updated is still exposed. The National Security Agency told organizations that can’t update yet to take their systems offline. @kimmonismus sums up the timeline: “Finding it was only the beginning: getting fixes ready took two months of coordination across maintainers, security companies and governments.”

@levelsio pulls the plug.

@levelsio pre-emptively disconnected all his sites and VPS servers from the web and waited for the patch to hit at 2 PM UTC. “If you have a PHP website, probably good to take them down until you patch PHP,” he wrote, adding that 69.3% of the web runs on PHP. Asked about firewalls, he said it is not clear at all a WAF fully protects it. When a follower said Cloudflare WAF had already pushed a rule, he called it “an imperfect STOP GAP solution.”

He also told a story. He warned a friend at a big tech corporate whose entire infrastructure runs on PHP. The friend replied that he would try to patch it in a few days, being out of office. “People won’t update fast enough and the vulnerability will be out in the wild once the patch hits as anyone can reverse engineer it based on the patch,” @levelsio wrote.

When one critic called it insane for a business his size to disconnect every site, he replied: “It’s not insane, it’s safety first.” Then Ubuntu shipped a fix, notice USN-8948-1. “Ask your clanker to install it,” he wrote. Asked why Ubuntu’s version number differed from PHP’s, he quoted that distributions routinely backport security patches to their packaged PHP versions. By 16:27 UTC he posted that everything was back up, thanking @ubuntu and @ThePHPF.

Our Afternoon Feature on the Security desk walks through the two flaws, how they work and what to do, with sources from PHP, CISA and others.