Artificial Intelligence · Cybersecurity
OpenAI and Google models find PHP vulnerability
OpenAI said GPT-5.6 Sol found a critical PHP vulnerability during its Patch-the-Planet effort, and Wiz said it later found the same flaw independently with Gemini 4 Argon and Wiz Atlas.
- OpenAI said GPT-5.6 Sol identified a critical PHP vulnerability as part of its Patch-the-Planet initiative.
- Wiz said it independently found the same flaws using its Wiz Atlas platform and Google’s Gemini 4 Argon.
- The repair was co-ordinated over two months in five phases with PHP developers, Wiz, Cloudflare, CISA and the White House.
- OpenAI said a tool on GitHub now lets server operators check whether their PHP version is affected.
OpenAI said GPT-5.6 Sol found a PHP vulnerability during the Patch-the-Planet initiative. The company said the model identified the issue before attackers did and that a GitHub tool now allows operators to check whether their version is affected.
Wiz said it independently found the same flaws using Wiz Atlas together with Google’s Gemini 4 Argon and GPT-5.6 Sol. According to Wiz, Gemini 4 Argon was useful for finding the vulnerability, creating exploits, building detection and checking the patch.
Wiz said large language models can automatically adapt exploits to different PHP versions, configurations and memory layouts. The company said that lowers the effort needed to scale attacks and can make flaws that once seemed impractical become usable targets.
The fix was co-ordinated over two months in five phases with PHP developers, Wiz, Cloudflare and US bodies including CISA and the White House. OpenAI said it wanted the process to serve as a repeatable model for future AI-related security discoveries and said such findings may rise sharply in the coming months.
Named in this story
Companies
- OpenAI
- said GPT-5.6 Sol found the flaw
- provided Gemini 4 Argon for the independent search
- Wiz
- independently found the same flaws and helped coordinate the fix
- Cloudflare
- took part in the co-ordination of the fix
Organisations
- Patch-the-Planet initiative
- was the OpenAI effort under which the flaw was found
Governments and agencies
- CISA
- joined the co-ordination of the fix
- White House
- joined the co-ordination of the fix
Products and systems
- GPT-5.6 Sol
- found the PHP vulnerability during Patch-the-Planet
- Gemini 4 Argon
- helped Wiz find and validate the vulnerability
- PHP
- had the vulnerable versions and configurations
- Wiz Atlas
- was the platform Wiz used in the search
How the source tells it
The source reads like a security trade piece, mixing factual reporting with vendor-led claims about scale, speed and attacker risk.
- alarm a critical-label vulnerability is linked to millions of websites and a before-attackers framing
- hype the initiative is described with the company's own superlative wording
- urgency the story stresses a narrow response window and a two-month co-ordination effort
- threat inflation broad claims about language models adapting exploits across versions and configurations