OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon identified a critical PHP vulnerability capable of compromising millions of websites globally. The discovery emerged through the Patch-the-Planet initiative, where the models located the flaw before malicious actors could exploit it. Security firm Wiz independently confirmed the issue using its Wiz Atlas platform alongside the same AI tools, noting that Gemini 4 Argon proved particularly effective for developing exploits and validating patches. A GitHub tool now allows server operators to check if their PHP versions are affected. The remediation process spanned two months across five phases involving PHP developers, Wiz, Cloudflare, and US agencies including CISA and the White House. OpenAI intends to use this coordinated response as a repeatable framework for future AI-driven security findings.
The incident highlights how large language models alter the dynamics of software security by lowering the barrier for attackers. Previously, adapting exploits to different PHP versions required significant manual effort. AI systems can now automatically adjust attacks across various configurations and memory layouts, turning previously impractical vulnerabilities into viable targets. While this capability accelerates defensive patching, it simultaneously enables faster and more scalable offensive operations. The event feeds into ongoing debates regarding the dual-use nature of AI in cybersecurity. OpenAI warns that findings on this scale will likely increase sharply in the coming months. The dual threat remains clear.
- Wiz confirmed AI could automatically adjust exploits across different PHP versions.
- The fix involved coordination between five phases over two months.
- OpenAI proposes this process as a repeatable framework for future discoveries.
