OpenAI Says AI Found One Of The Biggest Web Weaknesses Ever

OpenAI, Google-owned Wiz and cybersecurity startup Calif say AI discovered two critical bugs in software that undergirds 70% of websites on the internet. “We consider this one of the most impactful security issues in recent memory,” OpenAI wrote in a blog post.

Website owners are scrambling today to patch the flaws in widely-used web programming language called PHP. While languages like HTML and CSS handle what you see on a website, PHP handles things that you don’t, like checking logins are correct and processing payments.

Government agencies from the FBI to the U.K.’s GCHQ are urging people to push out security fixes as soon as possible. In Europe, some governments have taken down their websites entirely while they patch them.

Researchers at OpenAI, Calif and Wiz say they used a mix of OpenAI’s GPT-5.6 Sol and Google Gemini 4 Argon models to uncover and attack the flaws, which have been sitting in PHP code for over a decade, though have never been exploited. A hacker could use the vulnerabilities to install malware on a vulnerable web server or steal sensitive customer data.

“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” Wiz’s researchers wrote in their blog, dubbing the AI-generated exploits “php2shell.”

“Demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”

A patch is available to download from the PHP website. Users of Cloudflare’s web application firewall are also protected, thanks to an update from the web security company.