OpenAI said on Wednesday that its AI model, GPT-5.6 Sol, helped find a critical security flaw in PHP. PHP is a programming language that runs millions of websites worldwide. The finding has raised concerns about the safety of online services, because attackers could exploit such weaknesses to gain access to affected systems.
The company said a researcher named Calif identified the flaw as part of its Patch the Planet initiative. Cybersecurity firm Wiz also independently discovered and reported two vulnerabilities affecting PHP. OpenAI said it worked with PHP developers, security researchers and technology companies, including Wiz and Cloudflare, over the past two months. The aim was to address the problems before the details were made public.
OpenAI also warned that the same AI technology could be used for cyberattacks. The company said this creates a new challenge for cybersecurity teams. It added that more vulnerabilities could be found, as the PHP flaws are not the only major security problems its researchers have discovered.
OpenAI expects the number of similar discoveries to grow in the coming months. It said AI models are becoming more capable of examining software and identifying weaknesses. The company has also committed $1 billion in subsidised access to its Daybreak AI capabilities through an initiative called Daybreak for Frontline Defenders.
OpenAI is also providing a PHP version-checking tool. Website operators can use it to find potential security flaws in vulnerable software and to learn which security updates they need.
The NSA Cyber division of the US National Security Agency has recommended that all organisations using PHP prepare for an update addressing the two critical vulnerabilities. It said: “PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.”
