OpenAI says its AI model found critical PHP flaws, expects more such finds soon
In short
OpenAI said on 21 October that an AI model, GPT-5.6 Sol, was used to find a critical vulnerability in the PHP programming language, for which a fixed version was released the same day. OpenAI expects similar discoveries to rise sharply over the next few months. Japanese outlets also reported internet service outages and government website suspensions around the update.
Read the full story 2 min read
OpenAI said on 21 October, US time, that an AI model had been used to discover a vulnerability in PHP, an open-source programming language. A fixed version was released the same day, ITmedia AI+ reported. OpenAI predicted that similar discoveries will rise sharply over the next few months. [ 1 , 2 , 3 ]
According to ITmedia and Impress Watch, security firm Calif used OpenAI's GPT-5.6 Sol to find the flaw as part of OpenAI's "Patch the Planet" project to support open-source software security. ITmedia said OpenAI worked for two months with partner companies and the US government to prepare for publication of the vulnerability and the fix. Impress Watch said PHP maintainers led the fix and release, while OpenAI's team, Wiz, Cloudflare and others contributed research, technical support and coordination. [ 1 , 2 ]
Both outlets said Wiz found the vulnerability independently. ITmedia said Wiz told it that it had used GPT-5.6 Sol and Google's Gemini 4 Argon, among other models. Impress Watch described Wiz as Google-owned. Nippon TV said OpenAI named two cybersecurity companies as having found the flaws with AI models. [ 1 , 2 , 3 ]
Nippon TV reported that two serious flaws, which could lead to external unauthorized manipulation, were found in PHP, which it said is used on about 70% of the world's websites. It said the development team released a fix on 21 October and urged prompt updating. Impress Watch said many internet services in Japan and abroad stopped around the 23:00 release of the security update. Nippon TV said government websites in the Netherlands, Finland and other countries were suspended temporarily as a precaution. [ 2 , 3 ]
OpenAI called the issue one of the most impactful security problems in recent years, according to Impress Watch and Nippon TV. ITmedia said OpenAI pointed out that attackers can also misuse AI. Impress Watch said OpenAI described the bug as one of several critical vulnerabilities it has already found and is working to fix. ITmedia said OpenAI would offer support through its security programs and work on a framework for vulnerability response built around AI. [ 1 , 2 , 3 ]
Impress Watch said OpenAI offers a PHP version checker and plans to release a Codex skill so operators can identify potentially vulnerable PHP versions and decide which updates to apply. It said OpenAI will also provide support through Daybreak for Frontline Defenders, and will share a proposed approach for handling critical software vulnerabilities and invite the security community to help improve it. [ 2 ]
Why it matters
OpenAI described the issue as one of the most impactful security problems in recent years and warned that attackers can also use AI. Outlets reported service outages and, in some countries, government websites taken offline as a precaution.
Key facts
- OpenAI announced on 21 October (US time) that its AI model found a vulnerability in the open-source language PHP, for which a fixed version was published the same day. [ 1 , 2 , 3 ]
- Security firm Calif used OpenAI's GPT-5.6 Sol under OpenAI's "Patch the Planet" project to identify the flaw. [ 1 , 2 ]
- Security firm Wiz independently found the vulnerability, according to ITmedia and Impress Watch. [ 1 , 2 ]
- OpenAI called it one of the most impactful security problems in recent years and said it expects similar discoveries to rise sharply over the coming months. [ 2 , 3 ]
- Nippon TV reported two serious flaws that could lead to external unauthorized manipulation, and said PHP is used on about 70% of the world's websites. [ 3 ]
- OpenAI offers a PHP version checker and plans to release a Codex skill to help operators identify vulnerable PHP versions. [ 2 ]
Confirmed by several sources
- OpenAI said on 21 October that an AI model was used to find the PHP vulnerability. [ 1 , 2 , 3 ]
- OpenAI expects similar discoveries to increase sharply in the coming months. [ 1 , 2 , 3 ]
- A fixed PHP version was released on 21 October. [ 1 , 3 ]
- Security firm Calif found the flaw with GPT-5.6 Sol, and Wiz found it independently. [ 1 , 2 ]
Still unclear
- How many vulnerabilities were involved. Nippon TV reports two flaws, Impress Watch refers to both vulnerabilities, while ITmedia refers to one vulnerability.
- Which AI models Wiz used. Only ITmedia says Wiz, by its own account, used GPT-5.6 Sol and Google's Gemini 4 Argon, among others.
- The scale of the disruption and its link to the flaw. Impress Watch reported many internet services stopped around the 23:00 update on 21 October; Nippon TV reported government websites in the Netherlands, Finland and other countries were suspended as a precaution. Neither gives figures.
What local media are saying
Timeline, local time
- Security update for PHP published on 21 October, with many internet services reported stopped around this time. [ 2 ]
- ITmedia AI+ publishes its report on 22 October on OpenAI's announcement. [ 1 ]
- Impress Watch publishes its report on 22 October. [ 2 ]
- Nippon TV News publishes its report on 22 October. [ 3 ]