Dead internet theory could soon become a reality in the literal sense. Two critical vulnerabilities in PHP, the programming language powering an estimated 70% of websites, have triggered an emergency security response. OpenAI says its GPT-5.6 Sol model helped uncover one of the flaws, highlighting how advanced models can expose weaknesses across the internet before attackers exploit them.
Both vulnerabilities received severity scores of 9.2 out of 10. PHP released emergency patches on Wednesday, October 21, following weeks of coordinated work among researchers and software maintainers. The immediate concern is whether website administrators can secure vulnerable servers before hackers turn the newly disclosed flaws into widespread attacks.
How OpenAI found the flaws
OpenAI detailed the discovery in a Wednesday blog post about its Patch the Planet initiative. The effort brought together software maintainers, security researchers and infrastructure providers to prepare fixes before public disclosure.
A self-described hacker team called Calif used GPT-5.6 Sol to identify one of the vulnerabilities. Cybersecurity firm Wiz independently discovered and reported both flaws, according to OpenAI.
PHP’s development team led the patching effort, with OpenAI, Wiz and Cloudflare contributing research and technical support. The vulnerabilities required extensive coordination because their impact could extend across countless independently operated websites and servers.
OpenAI said frontier models identified the flaws before attackers did, giving defenders time to prepare. That window matters because publishing technical details can help other researchers understand a vulnerability, but it can also give hackers a starting point.
Hackers could seize server control
The vulnerabilities can enable remote code execution, allowing an attacker to run malicious commands on an affected server. Depending on the server’s configuration and permissions, a successful attack could expose sensitive information or compromise the system.
PHP’s official security advisory urges users to update immediately. The release includes fixes for supported branches, with emergency updates also available for certain older versions. Administrators should check PHP’s official guidance to identify the correct package for their installations.
Security experts are already concerned about attempts to weaponize the flaws. WatchTowr reproduced one of the exploits, while its head of threat intelligence, Jake Knott, warned that attacks could escalate quickly.
“As expected, watchTowr Intel is already observing in-the-wild exploitation of the latest PHP vulnerabilities,” Knott said in an email Wednesday morning, as reported by CNET. He added that nobody had succeeded at that point, but warned, “we don’t expect that will last long.”
Cloudflare Chief Technology Officer Dane Knecht said Wednesday that the company had deployed a fix to its firewall. The US National Security Agency also urged organizations to prepare for immediate updates. It advised taking affected systems offline if administrators could not patch them promptly.
Finding bugs is only half
OpenAI’s disclosure points to a growing tension in cybersecurity. More capable models can help researchers uncover deeply embedded flaws, but attackers may also use similar tools to develop exploits faster.
If you are wondering whether your website is affected, we have packaged a Codex skill to help check.
— OpenAI (@OpenAI) October 21, 2026
Point your Codex at this repo to guide you through it: https://t.co/XUEbOwXuQC https://t.co/BDaIIaJ4yK
The company acknowledged that risk directly, warning that the same capabilities can help malicious actors build offensive tools. It expects discoveries of similarly consequential vulnerabilities to increase sharply in the coming months.
Finding a flaw, however, does not automatically secure the internet. Software maintainers must develop reliable patches, hosting providers need to deploy protections, and website operators must update systems they control. Older installations can complicate that process, particularly when administrators cannot upgrade immediately.
The PHP incident also shows why coordinated disclosure matters. Researchers spent weeks working with maintainers and security providers before releasing details that could help defenders and attackers alike.
That preparation has now given website operators a path to remediation. The remaining uncertainty is how quickly they can act before attackers turn public knowledge of the flaws into widespread compromises.