AI helped uncover PHP flaws, and operators still have to deploy the fixes

GPT-5.6 Sol contributed to identifying one flaw

OpenAI says Calif used GPT-5.6 Sol to identify one critical flaw, while Wiz independently discovered and reported both vulnerabilities. PHP maintainers led the fixes and release, with researchers, security providers and infrastructure partners helping verify and coordinate the response.

The model’s contribution sat within a larger research effort. The PHP Foundation says early signs of the out-of-memory issue behind one vulnerability had surfaced in 2024; later work established a path to remote code execution. Discovery, validation, compatibility decisions and patch releases involved different teams.

Four maintained branches received fixes

On Oct. 21, the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical vulnerabilities. Under certain conditions, an unauthenticated request could lead to remote code execution.

The PHP security advisory says an update is the only complete solution. Organizations on older branches need to check with their distribution or hosting provider for a backported fix; a product label alone does not establish that a running service is protected.

Some sites went offline while operators patched

The Associated Press reported that the FBI advised operators who could not update promptly to consider taking their sites offline. Parts of Finland’s government web presence were temporarily unavailable. Faster discovery still leaves operators to inventory running versions, obtain vendor packages, deploy the update and verify it.

OpenAI says that, to its knowledge, frontier AI found the vulnerabilities before attackers did. The PHP Foundation says its team had not identified a functional exploit at the time of the coordinated release. Both statements are tied to a specific disclosure window; neither establishes the upgrade status of every service. Current reporting does not provide a complete patch rate.

Sources for this reading

Associated Press, “Some websites go dark as operators address an AI-detected flaw in a web programming language”; page published Oct. 21, 2026 at 17:43:01 UTC; direct link: https://apnews.com/article/php-websites-fbi-europe-vulnerability-a0af9576808a0963efca8df14d4b5183

Axios, “AI uncovers massive flaw in web’s foundational code”; page published Oct. 21, 2026 at 21:26:24 UTC; direct link: https://www.axios.com/2026/10/21/php-openai-ai-bug-hunting-cyberattacks

OpenAI, “Patch the Planet: global response coordination as agents uncover critical vulnerabilities”; page dated Oct. 21, 2026, with no time or time zone stated; direct link: https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/

The PHP Foundation, “Today’s PHP Security Release, and How We’re Strengthening PHP Security”; page dated Oct. 21, 2026, with no time or time zone stated; direct link: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/