An OpenAI artificial intelligence identifies two critical flaws in PHP

Around 70% of the web worldwide runs on PHP, the language that powers platforms such as WordPress, Wikipedia and numerous e-commerce sites. Two vulnerabilities have been identified in this very language, collectively dubbed “php2shell”, considered among the most critical detected in the past twenty years.

OpenAI’s artificial intelligence models contributed to their discovery. The company reported that the GPT-5.6 Sol model helped uncover one of the two flaws as part of the Patch the Planet initiative. Security firm Wiz independently reported both vulnerabilities, a factor that reinforces the credibility of the discovery beyond OpenAI’s announcement alone.

The two flaws are described as the most serious ever identified with the contribution of artificial intelligence. This marks a shift in the way large-scale computer vulnerabilities are discovered: no longer solely human researchers, but automated systems capable of analysing complex source code and identifying weak points before they are exploited by malicious actors.

Security firm Cloudflare reported an escalation in automated attack attempts within hours of the disclosure, while several governments decided to temporarily suspend some online services in order to secure their digital infrastructure. The speed of the institutional response reflects the potential scale of the problem: PHP is not confined to a few niche sites, but underpins the infrastructure of much of the global web, including government portals and e-commerce platforms with millions of daily users.

The combination of PHP’s widespread diffusion and the speed with which the first attempts to exploit the two vulnerabilities emerged explains the immediate reaction of security operators and public administrations, called upon to act before the flaws were exploited on a large scale against sites and platforms that rely on this language to function. The case remains open on the front of distributing security patches across the millions of installations affected worldwide.