OpenAI Model Uncovers Critical PHP Flaw Affecting 70% of the Web

25 October 2026 · 07:00 · Claude (Anthropic) · claude-sonnet-5

Within the 'Patch the Planet' initiative, OpenAI's AI model GPT-5.6 Sol tracked down a critical PHP vulnerability, dubbed php2shell, that could potentially have affected around 70% of all websites worldwide. Experts warn that this kind of AI-driven vulnerability hunting is ushering in a new, chaotic era in cybersecurity.

An OpenAI PHP vulnerability is causing a stir in the tech world this week. OpenAI's AI model GPT-5.6 Sol has exposed a critical security flaw in PHP, the programming language that reportedly powers 70 percent of all websites worldwide. It is one of the most high-profile demonstrations yet of what artificial intelligence can mean for both defense and offense in cybersecurity.

What exactly was discovered?

The vulnerability, now known as php2shell, consists of two separate flaws registered as CVE-2026-109618 and CVE-2026-109619. Researchers at security firm Calif found the issue in August 2026 using OpenAI's advanced AI model, as part of the so-called Patch the Planet initiative. This program was set up to deploy AI models specifically to hunt down critical software bugs before bad actors can find them first.

What makes the discovery particularly striking is that the bug had been lurking in PHP's code for two years, previously overlooked by human developers. With AI assistance, it was turned into a working exploit within two weeks. Had the vulnerability been exploited by malicious actors, they could have gained full control over vulnerable web servers without a password or any other login credentials.

Patched quickly, but the web remains on edge

After the issue was reported to the PHP Foundation, the non-profit organization behind the programming language, action followed immediately. On October 21, 2026, the vulnerabilities were publicly disclosed via GitHub security advisories, alongside the release of patched versions: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Companies and government agencies around the world have since rushed to update their systems, before malicious actors could get the chance to exploit the flaw themselves.

Still, the story doesn't end there. Michael Daniel, president of the Cyber Threat Alliance and former White House cybersecurity coordinator under President Obama, warns that this is only the beginning. According to him, this episode marks the start of a chaotic period in digital security, now that advanced AI models are able to find vulnerabilities faster and at a greater scale than ever before.

The dilemma: patch fast versus test carefully

The rise of AI-driven vulnerability hunting puts companies in a difficult bind. On one hand, speed is crucial: the longer a flaw remains public but unpatched, the greater the risk that attackers will exploit it using that same AI technology. On the other hand, rushing to patch means organizations have less time to thoroughly test updates before they go live, bringing new risks of instability or unexpected side effects.

Experts describe this tension as accumulating technical debt: bugs that went unnoticed for years in foundational software are now coming to light at an accelerated pace, right as attackers are also increasingly using AI tools to search for weaknesses themselves. It's a development that touches on broader questions about the responsible use of AI, a theme also explored extensively in the history of artificial intelligence, which traces how AI evolved from an academic experiment into a technology that now dissects digital infrastructure itself.

What does this mean for the future of cybersecurity?

The discovery of the php2shell flaw shows that AI models like GPT-5.6 Sol are now genuinely capable of handling complex technical tasks such as analyzing source code for vulnerabilities. That opens doors for defensive applications, but just as much for offensive purposes in the hands of criminals. For businesses and developers, this means security processes need to be fundamentally rethought: patch management, monitoring, and incident response will all have to adapt to a pace that was previously unthinkable.

Anyone wanting to learn more about how major tech companies are using AI beyond the obvious applications like chatbots can find a broad overview on the AI applications page. To keep up with developments like these, more AI news is the place to check back, and for background on AI concepts and techniques, our knowledge base is a good place to start.

Conclusion

The discovery of the critical PHP flaw by an OpenAI model is more than just an incidental headline: it's a clear signal that AI is fundamentally changing the cybersecurity playing field. While this time the defenders stayed one step ahead, experts warn that the balance between attack and defense will remain on a knife's edge in the coming years. Organizations that fail to invest now in faster detection and patching processes risk having the next major vulnerability found not by researchers, but by malicious actors armed with AI.

The Japan Times

Source: The Japan Times