What changed
AI models from OpenAI, including GPT-5.6 Sol, and Google's Gemini 4 Argon identified a critical PHP vulnerability that could affect millions of websites worldwide. The discovery was made as part of the Patch-the-Planet initiative, which OpenAI described as one of the 'most impactful security issues in recent memory.' The models detected the flaw before potential attackers could exploit it, providing developers and security vendors with time to respond.
What this means in practice
A tool on GitHub now allows server operators to check if their PHP version is affected by the vulnerability. Security firm Wiz independently found the same flaws using its Wiz Atlas platform alongside the AI models. Gemini 4 Argon was particularly effective in identifying the vulnerability, developing exploits, building attack detection mechanisms, and validating the patch, according to Wiz.
Limitations and availability
The vulnerability was addressed through a coordinated effort over two months, involving PHP developers, Wiz, Cloudflare, and US agencies such as CISA and the White House. OpenAI is proposing this process as a framework for future AI-driven security discoveries. The company warns that the same AI capabilities that find vulnerabilities can also be used by attackers to exploit them. The supplied announcement does not specify the exact nature of the vulnerability or the specific PHP versions affected.
