Industry heavyweights OpenAI, Google-backed Wiz, and cybersecurity venture Calif have revealed that artificial intelligence successfully uncovered two severe bugs within software powering roughly 70 percent of all global websites. Describing the gravity of the situation, OpenAI stated in an official blog post that they deem this among the most impactful security concerns witnessed in recent memory.

Global Scramble for Emergency Patches

Web administrators worldwide are rushing to secure their systems against the newly exposed vulnerabilities impacting PHP, a foundational programming language. While languages like HTML and CSS dictate the visual presentation of a site, PHP operates behind the scenes to manage critical functions such as login verification and payment processing.

International cybersecurity authorities, ranging from the FBI to the UK's GCHQ, are strongly advising immediate deployment of security updates. The threat has prompted some European government bodies to temporarily take their official web portals offline entirely while emergency mitigation takes place.

The Role of Frontier AI in Discovery

According to researchers from OpenAI, Calif, and Wiz, the discovery relied on a combination of OpenAI’s GPT-5.6 Sol and Google Gemini 4 Argon models. These advanced systems were utilized to locate and attack the flaws, which had remained hidden within the PHP codebase for more than a decade without prior exploitation. If exploited, attackers could leverage these weaknesses to deploy malware onto vulnerable servers or exfiltrate confidential customer records.

These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.

Wiz researchers, who labeled the AI-crafted exploits as "php2shell," emphasized the unprecedented capabilities demonstrated by the technology. Proving the exploitability of these flaws demanded an extraordinarily complex chain of actions that pushed the limits of practical human research. Frontier AI models effectively lowered this barrier, transforming a dormant, long-standing architectural weakness into an active threat vector.

Mitigation and the Evolving Cyber Landscape

Official patches are currently available for download via the PHP foundation website. Additionally, customers utilizing Cloudflare’s web application firewall receive automatic protection following a recent infrastructure update issued by the company.

This event highlights a broader trend: artificial intelligence is growing increasingly proficient at identifying security gaps, particularly within open-source frameworks like PHP, while simultaneously proving effective in executing sophisticated cyberattacks. Reflecting on the paradigm shift, OpenAI cofounder Greg Brockman noted that the industry is entering a new chapter in digital defense where models can isolate internet-scale vulnerabilities, requiring defenders everywhere to harness AI to secure shared infrastructure.