The vulnerability was found by multiple research groups using AI to hunt for security flaws. OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon both played a role in the discovery. The teams treated it as an emergency, and the PHP foundation announced a critical patch on October 20, with a coalition of companies including OpenAI, Wiz, and Calif disclosing the fix the next day.
However, news of the exploit leaked before the scheduled public disclosure. Hackers began attacking systems on October 17, and after the patch was announced, "millions" of attempts to exploit the bugs followed. Many governments and private entities temporarily took web services offline to protect them while waiting for the patch to be applied. WordPress, the most affected service, reported no issues.
The incident highlights a growing trend: AI-powered cyberattacks and defenses. OpenAI has been expanding its Daybreak program, which provides vetted organizations with advanced AI tools to find and patch vulnerabilities. The program's numbers have grown from 858 flaws found to 1,885, and patches produced from 263 to 661. OpenAI president Greg Brockman posted about the PHP exploit, and the company plans to debut a new cybersecurity-focused model and deployment tool this fall. Anthropic runs a similar program called Project Glasswing.
Security professionals warn that as AI models become more powerful at processing code and acting autonomously, both attackers and defenders will increasingly rely on AI. The PHP incident may be an early sign of what experts call a new era for internet safety.