# OpenAI and Google AI models spot critical PHP bug affecting many sites

> GPT‑5.6 Sol and Gemini 4 Argon identified a severe PHP flaw; a GitHub tool now lets operators test their servers.

Oossa · 2026-10-21 · https://oossa.com/en/openai-and-google-ai-models-spot-critical-php-bug-affecting-many-sites

OpenAI’s GPT‑5.6 Sol and Google’s Gemini 4 Argon discovered a critical vulnerability in the PHP programming language. The find was part of OpenAI’s Patch‑the‑Planet effort, which the company calls one of the most impactful security issues it has seen. A new GitHub utility now allows web‑server owners to check if their PHP version is vulnerable.

## How the AI models helped

The models spotted the flaw before any public exploit appeared, giving developers and security firms a chance to respond. Security firm Wiz independently found the same issue using its Wiz Atlas platform together with Gemini 4 Argon and GPT‑5.6 Sol. Wiz says the AI was especially useful for locating the bug, writing proof‑of‑concept exploits, creating detection rules, and confirming that patches worked.

## Implications for attackers and defenders

Wiz notes that tweaking an exploit for different PHP versions used to be labor‑intensive. Large language models can rewrite the code automatically for many versions, lowering the effort needed to launch attacks at scale. The same capability could also help defenders automate patches and detection.

## The facts

- The vulnerability was found by OpenAI’s GPT‑5.6 Sol and Google’s Gemini 4 Argon.
- Security firm Wiz confirmed the flaw using its Wiz Atlas platform.
- A GitHub tool now lets server operators test their PHP installations for the bug.
- The fix was coordinated over two months in five phases with PHP developers, Wiz, Cloudflare, CISA and the White House.

## Why it matters

Website owners can now verify if their servers are exposed and apply the patch, reducing the risk of mass attacks. At the same time, the ability of AI to rewrite exploits means attackers could more easily target unpatched sites, so staying up‑to‑date becomes even more important.

## Sources & references

1. [OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon found critical PHP flaw affecting millions of websites](https://the-decoder.com/openais-gpt-5-6-sol-and-gemini-4-argon-discovered-the-critical-php-vulnerability-affecting-millions-of-websites/) – The Decoder, 2026-10-21

Last updated: 2026-10-21