The theory of the dead Internet could soon become a reality in the truest sense of the word. Two critical vulnerabilities in PHP, the programming language that powers an estimated 70% of all websites, have triggered an emergency security response. OpenAI says its GPT 5.6 Sol model helped uncover one of the flaws and shows how advanced models can uncover vulnerabilities across the internet before attackers exploit them.
Both vulnerabilities received a severity score of 9.2 out of 10. PHP released emergency patches on Wednesday, October 21, after weeks of coordinated work by researchers and software maintainers. The immediate concern is whether website administrators can protect vulnerable servers before hackers turn the newly discovered vulnerabilities into widespread attacks.
How OpenAI found the defects
OpenAI detailed the discovery in a blog post Wednesday about its Patch the Planet initiative. The effort brought together software maintainers, security researchers and infrastructure providers to prepare fixes before release.
A self-proclaimed hacking team called Calif used GPT-5.6 Sol to identify one of the vulnerabilities. According to OpenAI, cybersecurity firm Wiz discovered and reported both vulnerabilities independently.
The PHP development team led the patching effort, with OpenAI, Wiz, and Cloudflare contributing research and technical support. The vulnerabilities required extensive coordination because their impact could extend to countless independently operated websites and servers.
OpenAI said Frontier models detected the vulnerabilities before attackers did, giving defenders time to prepare. This window is important because publishing technical details can help other researchers understand a vulnerability, but it can also provide hackers with a starting point.
Hackers could take control of the server
The vulnerabilities could allow remote code execution, allowing an attacker to execute malicious commands on an affected server. Depending on the server’s configuration and permissions, a successful attack could reveal sensitive information or compromise the system.
PHP’s official security advisory urges users to update immediately. The release includes fixes for supported branches, with emergency updates also available for certain older versions. Administrators should check the official PHP guides to determine the correct package for their installations.
Security experts are already concerned about attempts to exploit the vulnerabilities. WatchTowr reproduced one of the exploits, while Jake Knott, head of threat intelligence, warned that attacks could quickly escalate.
“As expected, watchTowr Intel is already observing exploitation of the latest PHP vulnerabilities in the wild,” Knott said in an email Wednesday morning, as reported by CNET. He added that no one had succeeded at this point, but warned: “We don’t expect this to last long.”
Dane Knecht, Cloudflare’s chief technology officer, said Wednesday that the company has deployed a solution to its firewall. The US National Security Agency also urged organizations to prepare for immediate updates. It was recommended that affected systems be taken offline if administrators were unable to patch them promptly.
Finding errors is only half of it
OpenAI’s disclosure signals a growing tension in cybersecurity. More powerful models can help researchers uncover deep-rooted vulnerabilities, but attackers can also use similar tools to develop exploits more quickly.
The company directly acknowledged this risk and warned that these same capabilities can help malicious actors develop offensive tools. The discovery of vulnerabilities of similar scope is expected to increase sharply in the coming months.
However, finding an error does not automatically secure the Internet. Software maintainers must develop reliable patches, hosting providers must provide protection measures, and website operators must update the systems they control. Older installations can complicate this process, especially if administrators cannot upgrade immediately.
The PHP incident also shows why coordinated disclosure is important. Researchers worked with maintainers and security vendors for weeks before releasing details that could help defenders and attackers alike.
This preparation has now given website owners a path to remediation. The remaining uncertainty is how quickly they can act before attackers turn public knowledge of the vulnerabilities into widespread compromises.
