AI found PHP flaws could endanger 70% of websites, OpenAI says, as global scramble to patch begins

FBI and NSA urge web providers to take sites offline or update software after two 'critical' vulnerabilities disclosed

By LineZotpaper

Published21 October 2026

Updated21 October 2026

Read Time2 min

Sources5 outlets

Reactions1 on X

Cybersecurity researchers using OpenAI's GPT-5.6 Sol model have discovered two critical vulnerabilities in the PHP programming language, prompting the FBI and NSA to advise web providers to take systems offline or apply fixes urgently. OpenAI says as many as 70% of the world's websites could be exposed to attacks that steal user data or modify pages.

From the source

OpenAI @OpenAI

If you are wondering whether your website is affected, we have packaged a Codex skill to help check. Point your Codex at this repo to guide you through it: github.com/openai/php2she… x.com/OpenAI/status/…

QuotingOpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors. Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare. View post

21 Oct, 16:35 UTC View on X

A security flaw found with the help of an artificial intelligence model has triggered an international race to patch the web. OpenAI said its researchers identified two "critical" flaws in PHP, a widely used open-source language that powers much of the behind-the-scenes work on websites requiring logins, online orders and other interactive features.

The vulnerabilities were first found by Calif, a cybersecurity research company, working with OpenAI's GPT-5.6 Sol model. Wiz, another cybersecurity company, independently uncovered the issues, according to OpenAI. The work is part of "Patch the Planet," an OpenAI-led initiative aimed at securing global digital infrastructure.

OpenAI said the vulnerabilities appear to have been found before attackers discovered them, but the public disclosure on Wednesday started a race to update websites before the bugs could be exploited. Greg Brockman, president of OpenAI, said in a post on X that hackers could use the flaws to steal private user data or modify websites. The company described the issue as "one of the most impactful security issues in recent memory" in a blog post.

"We are seeing early attacks emerging and are updating mitigations as new vectors show up," Dane Knecht, chief technology officer of Cloudflare, said on X.

The US National Security Administration's cyber division advised all web providers using PHP to take their systems offline or update their software, and numerous websites, including those belonging to governments and media outlets, went offline on Wednesday to address the issue. The disclosure also drew messages from world leaders, including Japanese Prime Minister Sanae Takaichi, who said: "We have an urgent request for everyone to take action tonight."

Analysis

Why This Matters

PHP underpins a large share of the web's interactive sites, so flaws in the language can expose user data and site integrity at massive scale.
The public disclosure before patches are fully applied creates a race between defenders and attackers, with early attacks already reported.
The episode is an early, high-stakes demonstration of AI-assisted vulnerability discovery reshaping how critical software flaws are found and disclosed.

Background

PHP is a widely used open-source programming language that often handles behind-the-scenes work powering websites with user logins and online orders. Security researchers have increasingly turned to AI models to analyse code for weaknesses. Here, OpenAI's GPT-5.6 Sol was used in an initiative called "Patch the Planet," which aims to secure digital infrastructure, and two independent research companies reported finding the same issues.

Key Perspectives

OpenAI and the researchers: They frame the vulnerabilities as among the most impactful in recent memory, emphasise that flaws were identified before attackers found them, and released details publicly to push urgent patching. Web providers and site operators: Facing FBI and NSA guidance, many are taking systems offline or rushing updates, accepting temporary outages to avoid compromise. Attackers: The disclosure opens a window for exploitation, and Cloudflare says early attacks are already emerging, with new vectors appearing as mitigations roll out. Governments: Leaders such as Japan's prime minister are urging immediate action, reflecting concern that critical public services and infrastructure may be exposed.

What to Watch

Whether attacks escalate faster than patches are deployed across the estimated 70% of websites OpenAI says are at risk.
How quickly hosting providers, government agencies and media companies complete updates and bring sites back online.
Further technical details from OpenAI, Calif and Wiz that could change the scope of the threat or reveal additional affected systems.

Sources

A.I. Discovered a Critical Security Flaw Underpinning Websites · NYT > U.S. > Politics
A.I. Discovered a Critical Security Flaw Underpinning Websites · NYT > U.S. News
A major security flaw found using an OpenAI model is causing internet chaos · All Content from Business Insider
Some websites go dark as operators address an AI-detected flaw in a common web programming language · Boston Globe
Some websites go dark as operators address an AI-detected flaw in a web programming language · Philadelphia Inquirer

Checked

9 claims in this story checked against 1 source: 6 supported.

Show each claim

SupportedAI-assisted research found PHP flaws that could put as many as 70% of websites at risk, according to OpenAI.All Content from Business Insider: “OpenAI said that 70% of the world's websites could be in peril after cybersecurity researchers using its AI models found exploits in a popular programming language.”
Partly supportedThe FBI and NSA urged web providers to take sites offline or update their software.All Content from Business Insider: “The FBI and NSA have advised people to either take down websites or update their software. The National Security Administration's cyber division advised all web providers that use PHP, a widely used open-source language, to take their systems offline or update their software”
Partly supportedOpenAI said as many as 70% of websites could be exposed to attacks that steal user data or modify pages.All Content from Business Insider: “OpenAI said that 70% of the world's websites could be in peril”
SupportedResearchers using GPT-5.6 Sol found two critical PHP vulnerabilities.All Content from Business Insider: “after OpenAI said one of its models found two "critical" flaws in the language's infrastructure.”
Partly supportedCalif was the first to find the vulnerabilities while working with GPT-5.6 Sol.All Content from Business Insider: “The critical flaw was first identified by Calif, a cybersecurity research company using GPT-5.6 Sol .”
SupportedGreg Brockman said hackers could use the flaw to steal private user data or modify websites.All Content from Business Insider: “Greg Brockman , the president of OpenAI, said in an X post that hackers could exploit the vulnerability to steal private user data or modify websites.”
SupportedOpenAI called the issue “one of the most impactful security issues in recent memory.”All Content from Business Insider: “"We consider this one of the most impactful security issues in recent memory," OpenAI said in a blog post.”
SupportedCloudflare CTO Dane Knecht said, “We are seeing early attacks emerging and are updating mitigations as new vectors show up.”All Content from Business Insider: “"We are seeing early attacks emerging and are updating mitigations as new vectors show up," Dane Knecht, Cloudflare's chief technology officer, said in a post on X.”
SupportedJapanese Prime Minister Sanae Takaichi said, “We have an urgent request for everyone to take action tonight.”All Content from Business Insider: “"We have an urgent request for everyone to take action tonight," said Sanae Takaichi.”