Researchers claim the AI’s findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.”
OpenAI, Google-owned Wiz and cybersecurity startup Calif say AI discovered two critical bugs in software that undergirds 70% of websites on the internet. “We consider this one of the most impactful security issues in recent memory,” OpenAI wrote in a blog post.
Website owners are scrambling today to patch the flaws in widely-used web programming language called PHP. While languages like HTML and CSS handle what you see on a website, PHP handles things that you don’t, like checking logins are correct and processing payments.
Government agencies from the FBI to the U.K.’s GCHQ are urging people to push out security fixes as soon as possible. In Europe, some governments have taken down their websites entirely while they patch them.
Researchers at OpenAI, Calif and Wiz say they used a mix of OpenAI’s GPT-5.6 Sol and Google Gemini 4 Argon models to uncover and attack the flaws, which have been sitting in PHP code for over a decade, though have never been exploited. A hacker could use the vulnerabilities to install malware on a vulnerable web server or steal sensitive customer data.
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” Wiz’s researchers wrote in their blog, dubbing the AI-generated exploits “php2shell.”
“Demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”
A patch is available to download from the PHP website. Users of Cloudflare’s web application firewall are also protected, thanks to an update from the web security company.
AI is becoming increasingly adept at finding security flaws, especially in open-source software like PHP. It’s also good at launching cyberattacks. Last month, Forbes reported on a hacker who used Anthropic and DeepSeek models to steal over 600,000 credit card details in attacks on over 100 websites.
OpenAI cofounder Greg Brockman wrote on X, “I believe we’re entering a new phase of cybersecurity, where the models are able to find vulnerabilities with internet-scale impact… defenders everywhere have a part to play, applying models to their own defenses, finding and fixing issues in shared infrastructure, and sharing best practices that can ultimately make the internet more secure.”
Want to see more Forbes articles on your feed? Tap here to make Forbes Australia a preferred source on Google.
Look back on the week that was with hand-picked articles from Australia and around the world. Sign up to the Forbes Australia newsletter here or become a member here.
