According to The Decoder, OpenAI's GPT-5.6 Sol model discovered a critical security vulnerability in PHP as part of the Patch the Planet initiative. Millions of websites worldwide may be affected. The security company Wiz independently came across the same vulnerability, using Google's Gemini 4 Argon among other tools.
Why PHP matters so much
PHP is a programming language that runs on the server and generates web pages dynamically. Many content management systems, online shops and forums rely on it. A critical flaw in such a widely used foundation therefore doesn't affect just a single product. It can touch a very large number of installations at the same time.
In the security industry, "critical" usually means that a vulnerability is especially serious and should be fixed promptly. The report does not give the exact technical details. If you use PHP, you should therefore keep an eye on the official notices from the developers and from your own hosting provider.
It is also notable that the vulnerability was found independently by two parties. This suggests that AI models can now be a real help in searching for errors in code. At the same time, it shows that other parties could also notice such flaws.
Opportunity and risk at once
OpenAI itself points out that the same capabilities that let AI track down security vulnerabilities can also help attackers. Anyone who finds vulnerabilities faster can close them faster, but in the worst case can also exploit them faster. Experts call this dual use.
What operators can check now
- Find out which PHP version is running on your own server or at your hosting provider.
- Follow the notices from the PHP project and from your hosting provider.
- Apply any fixes promptly once they are available.
- Keep extensions and plugins up to date as well, since they build on PHP.
The case shows that regular updates are not a side issue. Especially when AI tools speed up the search for vulnerabilities, it can be worth building maintenance and updating firmly into your schedule.
