GPT-5.6 Sol and Gemini 4 Argon found a critical PHP flaw affecting millions of sites

Models from OpenAI and Google found a critical PHP vulnerability that could affect millions of websites, with OpenAI's GPT-5.6 Sol surfacing the flaw before attackers reached it and giving developers and security vendors a window to respond.

The discovery came through Patch-the-Planet, an initiative OpenAI describes as addressing "one of the most impactful security issues in recent memory." A checker published on GitHub now lets server operators test whether their PHP version is exposed, which is the whole point of finding a bug early: disclosure before exploitation.

Wiz found the same flaws independently, running its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. According to Wiz, Gemini 4 Argon was especially useful for finding the vulnerability, developing exploits, building attack detection and validating the patch. Two organizations and two technical paths converging on the same bug makes the finding harder to dispute.

The reason models matter here is cost. Adapting an exploit from one PHP installation to other versions and configurations used to take significant manual effort; large language models can adjust exploits across versions, configurations and memory layouts automatically. Wiz says this "significantly lowers the barrier to scaling attacks across different deployments," turning vulnerabilities that once seemed impractical to exploit into viable targets.

What models changed is not whether the bug existed but the economics of finding and adapting an exploit. Defenders get faster triage and attackers get cheaper replication, both from the same capability.

The fix was coordinated over two months across five phases, involving PHP developers, Wiz, Cloudflare and US agencies including CISA and the White House. OpenAI is proposing the process as a repeatable framework for future AI-driven security discoveries, an attempt to turn one unusually effective collaboration into a mechanism.

OpenAI expects findings on this scale to "increase sharply in the coming months," and warns that the same capabilities that find vulnerabilities can help attackers. The discovery feeds a longer-running argument about whether AI models are net defensive assets or an expansion of the attack surface.

The practical questions are adoption and tempo: how quickly affected servers patch, whether operators actually run the checker, and whether coordinated disclosure can keep pace once discovery accelerates. If AI raises the speed of finding bugs, patching, distribution and verification have to speed up with it.