By PYMNTS | October 21, 2026
OpenAI led an effort over the past two months to fix “one of the most impactful security issues in recent memory,” the company said in a Wednesday (Oct. 21) blog post.
The targets of this effort were critical vulnerabilities in PHP, an open-source programming language that is used to run websites and web applications, according to the post.
The vulnerabilities were discovered and reported independently by Calif and Wiz, and then PHP’s maintainers, supported by OpenAI, Wiz, Cloudflare and others, prepared protections before disclosing the vulnerabilities, the post said.
Organizations that use PHP are now applying the fixes, per the post.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
OpenAI’s GPT-5.6 Sol helped Calif discover the vulnerabilities, and OpenAI shared a PHP version as a Codex skill that helps operators identify PHP versions that may be vulnerable and determine which updates apply, according to the post.
“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI said in the post. “It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.”
“To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender’s Window for maintainers and security providers to prepare fixes and protections ahead of disclosure,” OpenAI said.
Wiz said in a Wednesday blog post that Wiz Research uncovered multiple vulnerabilities in PHP, that PHP powers 70% of the world’s websites and that successful exploitation of the vulnerabilities could allow attackers to take control of affected servers, steal sensitive data and deface the websites that run on them.
PHP released a patch Wednesday, according to the post.
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” Wiz said. “The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”
Cloudflare said in a Wednesday blog post that it developed protections against these vulnerabilities and deployed them about nine hours before the vulnerabilities were publicly disclosed.