AI-assisted discovery of a critical PHP vulnerability prompted a coordinated response involving developers, security companies and US agencies. OpenAI and Wiz describe separate discoveries using frontier models. The remediation effort ran over two months, while a version-checking tool helps server operators identify affected software. The companies also warn that the same capabilities can assist attackers.
A critical vulnerability in PHP, the programming language used for websites and web applications, prompted a coordinated repair effort after AI-assisted discovery. OpenAI describes work under its Patch the Planet initiative, while security company Wiz says it independently found the same flaws. PHP developers and security providers participated in the response.[1], [2]
OpenAI says GPT-5.6 Sol identified the weakness before attackers did. Wiz describes combining its Atlas platform with Google's Gemini 4 Argon and GPT-5.6 Sol. According to Wiz, Gemini helped with discovery, preparing attack detection and checking the repair. These descriptions concern the companies' own research, rather than an independent comparison of model performance.[1]
The response ran over two months and five phases. Participants included PHP developers, Wiz, Cloudflare, the US Cybersecurity and Infrastructure Security Agency and the White House. A GitHub tool lets server operators check whether their PHP version is affected. OpenAI proposes the coordination process as a framework for future serious discoveries. Both OpenAI and Wiz warn that capabilities used to find weaknesses can also help attackers.[1]
