AI models from OpenAI and Google helped identify a critical PHP vulnerability that could affect millions of websites, prompting a coordinated response involving PHP developers, security companies and U.S. government agencies. The flaw, referred to as PHP2Shell, also highlighted how AI can make software weaknesses easier both to discover and to exploit across different systems.
OpenAI’s GPT-5.6 Sol identified the vulnerability through the company’s Patch-the-Planet initiative. Security firm Wiz independently found the same flaws using its Wiz Atlas platform alongside GPT-5.6 Sol and Google’s Gemini 4 Argon. A tool available on GitHub now allows server operators to check whether their PHP version is affected.
OpenAI said the discovery came before attackers found the vulnerability, providing time for developers and security vendors to coordinate their response. The remediation effort ran for two months across five phases and involved PHP developers, Wiz, Cloudflare, the Cybersecurity and Infrastructure Security Agency and the White House. OpenAI is proposing the process as a framework that could be reused for future AI-assisted security discoveries.
Wiz described Gemini 4 Argon as particularly useful across several stages of its investigation: identifying the vulnerability, developing exploits, creating attack detection and checking the patch. Those tasks span both demonstrating that a weakness can be exploited and verifying that defensive measures address it.
A central concern raised by the research is the effort required to adapt an exploit to different environments. Wiz explained that an exploit working against one PHP installation previously could take substantial work to modify for another version or configuration. Differences in memory layout can also affect whether an exploit succeeds. The firm said large language models can automate those adjustments, reducing the work needed to target multiple deployments.
That distinction matters because discovering a vulnerability and exploiting it reliably are separate technical challenges. A weakness may exist in widely deployed software without an attacker having a dependable way to use it across installations. Automation that makes adaptation easier can change that calculation, turning weaknesses previously considered impractical to exploit into more viable targets.
PHP is a server-side programming language used extensively in web applications and content-management systems. Its broad use makes vulnerabilities in the language relevant to website operators as well as hosting providers. However, the potential reach of a flaw is not the same as a count of compromised websites, and the discovery does not establish that millions of sites have been attacked.
OpenAI expects discoveries comparable in scale to PHP2Shell to become more frequent in the coming months. Its warning is two-sided: the same capabilities that help researchers find vulnerabilities and validate repairs can also help attackers develop and adapt exploits. For operators assessing their own exposure, the GitHub checking tool provides a way to determine whether their installed PHP version is affected.
Sources: The Decoder