RESEARCH · RESEARCH · #2392
OpenAI and Wiz use AI to find critical PHP vulnerabilities; PHP Foundation issues patches
Researchers using OpenAI's GPT-5.6 Sol and Wiz's security tooling (Wiz Atlas and Gemini 4 Argon) discovered two severe, long-standing PHP vulnerabilities present since PHP 5; the PHP Foundation has released patches and the NSA urged sites that cannot immediately patch to go offline. OpenAI and Wiz coordinated responsible disclosure and testing with PHP and multiple hosting/CDN vendors; there were no reported exploits in the wild at disclosure.
KEY POINTS
- Researchers using OpenAI's GPT-5.6 Sol and Wiz's security tooling (Wiz Atlas and Gemini 4 Argon) discovered two severe, long-standing PHP vulnerabilities present since PHP 5; the PHP Foundation has released patches and the NSA urged sites that cannot immediately patch to go offline.
- OpenAI and Wiz coordinated responsible disclosure and testing with PHP and multiple hosting/CDN vendors; there were no reported exploits in the wild at disclosure.
- This matters because PHP powers a large majority of websites, so AI-enabled discovery (and the same AI capability that can adapt exploits) creates urgent, wide-ranging remediation needs.
WHY IT MATTERS
This matters because PHP powers a large majority of websites, so AI-enabled discovery (and the same AI capability that can adapt exploits) creates urgent, wide-ranging remediation needs.