OpenAI’s GPT‑5.6 Sol and Google’s Gemini 4 Argon discovered a critical vulnerability in the PHP programming language. The find was part of OpenAI’s Patch‑the‑Planet effort, which the company calls one of the most impactful security issues it has seen. A new GitHub utility now allows web‑server owners to check if their PHP version is vulnerable.
How the AI models helped
The models spotted the flaw before any public exploit appeared, giving developers and security firms a chance to respond. Security firm Wiz independently found the same issue using its Wiz Atlas platform together with Gemini 4 Argon and GPT‑5.6 Sol. Wiz says the AI was especially useful for locating the bug, writing proof‑of‑concept exploits, creating detection rules, and confirming that patches worked.
Implications for attackers and defenders
Wiz notes that tweaking an exploit for different PHP versions used to be labor‑intensive. Large language models can rewrite the code automatically for many versions, lowering the effort needed to launch attacks at scale. The same capability could also help defenders automate patches and detection.
Why it matters
Website owners can now verify if their servers are exposed and apply the patch, reducing the risk of mass attacks. At the same time, the ability of AI to rewrite exploits means attackers could more easily target unpatched sites, so staying up‑to‑date becomes even more important.
