OpenAI Model Finds Critical 22-Year PHP Flaw

Security researchers used OpenAI’s GPT-5.6 Sol model to find two severe flaws in PHP. The software powers nearly 70 percent of all web servers.

The flaws date back to 2004. They sat hidden in the core PHP codebase for 22 years. The bugs let attackers take full control of affected servers and steal private data.

The PHP Foundation shipped an emergency patch on Wednesday. Major services including Wikipedia, Steam, and state agencies pulled servers offline to apply the fix.

The National Security Agency (NSA) gave a blunt warning to web teams. If you cannot patch right now, pull your servers offline. Do not bring them back until they are secure.

Technical Factsheet: The 2026 PHP Core Vulnerability

Chronology: AI Zero-Day Discovery and Coordinated Disclosure

┌────────────────────────────────────────────────────────┐
│     CHRONOLOGY: OPENAI GPT-5.6 SOL & THE 2026 PHP FLAW │
├────────────────────────────────────────────────────────┤
│ 2004                                                   │
│   └── Vulnerability introduced into core PHP engine    │
│                                                        │
│ Early August 2026                                      │
│   └── Calif deploys GPT-5.6 Sol ('Patch the Planet')   │
│   └── AI analyzes legacy C code; isolates bugs in days │
│                                                        │
│ August 11, 2026                                        │
│   └── Calif privately submits zero-day report to PHP   │
│                                                        │
│ August 24, 2026                                        │
│   └── Wiz independently discovers & reports the flaw   │
│                                                        │
│ October 20, 2026                                       │
│   └── Premature leak on watchTowr intelligence portal  │
│                                                        │
│ October 21, 2026 (Wednesday)                           │
│   ├── PHP Foundation issues emergency patch releases   │
│   ├── Wikipedia, Steam & agency portals go offline     │
│   └── NSA issues directive: Patch or remain offline    │
└────────────────────────────────────────────────────────┘

How GPT-5.6 Sol Found Bugs Unseen for 22 Years

Cybersecurity firm Calif found the flaws while testing OpenAI’s GPT-5.6 Sol model. The work was part of OpenAI’s “Patch the Planet” project.

The AI model read through core C code in the PHP engine. Calif spotted the flaws in just a few days. Human coders, security audits, and static scanners had missed the bugs for over two decades. Calif alerted the PHP Foundation on August 11.

On August 24, Google-owned cloud security firm Wiz found the exact same bugs on its own. Wiz called the discovery one of the most severe flaws in PHP history, and perhaps in all software history.

“This is one of the most severe vulnerabilities discovered in PHP, and arguably in software history.”

Wiz Threat Research Team (Google Cloud Security)

The Rush to Patch and Web Blackouts

The news sent engineering teams around the world into a scramble.

Vast parts of the web went dark as teams took servers offline to patch. The New York Times reported that the public details allow bad actors to reverse-engineer exploits quickly. Attackers can use those exploits to seize control of target boxes and pull out sensitive data.

Big tech firms patched within hours. But millions of small websites, hobby blogs, and legacy setups do not have dedicated security staff. Those unpatched systems are now sitting ducks.

The NSA took the rare step of telling operators to pull unpatched sites off the public web entirely. The agency advised teams to keep them dark until the patch is in place.

The Debate: Did AI Spark the Crisis It Solved?

The launch was not clean. Details about the flaw leaked early on a site run by cybersecurity firm watchTowr. That leak forced teams to move before the planned announcement.

The incident has opened a fierce debate around OpenAI and frontier AI models.

OpenAI created the “Patch the Planet” effort to help secure the web. Yet critics point out that GPT-5.6 Sol found 22-year-old bugs in days. That speed creates an asymmetric race. Defensive teams and volunteer open-source maintainers cannot patch as fast as AI models find zero-day bugs.

An Atlantic headline captured the mood: The AI-Hacking Apocalypse Began Last Night. AI firms point to these discoveries as proof of model power. Meanwhile, sysadmins are left cleaning up the fallout across a disrupted web.

What Engineering Teams Must Do Right Now

If you run PHP on any server, treat this as a top-priority fire drill:

1. Update PHP runtimes immediately: The PHP Foundation released emergency patch builds across all active release branches on Wednesday.
2. Check legacy boxes and microservices: Many teams forget about internal tools and old staging servers. Audit all PHP-FPM pools running behind reverse proxies.
3. Pull unpatched systems off the public web: Cannot update a server right away? Put it behind a private VPN. Or take it offline until the patch is verified.

Formatting server configurations, Kubernetes manifests, or infrastructure definitions? Validate and convert your payloads with TeckScaler’s free client-side JSON to YAML Converter.

Primary Sources: The New York Times: PHP Vulnerability and OpenAI | watchTowr Intelligence: CVE-2026-109618 Advisory FAQ | The Atlantic: AI-Hacking Apocalypse Began Last Night