OpenAI described on October 21 how AI-assisted security analysis contributed to the discovery of serious vulnerabilities in PHP, the programming language behind a large number of websites and online services.
According to OpenAI, the security company Calif found a critical flaw with help from GPT-5.6 Sol through the Patch the Planet initiative. Wiz reportedly discovered and reported the same vulnerabilities independently. PHP’s own maintainers led the fixes and release, while several security and infrastructure organisations helped test protections and prepare guidance before technical details were disclosed.
The verified point in OpenAI’s account is not that an AI single-handedly “saved the internet”. The model helped researchers identify suspicious problems. People validated the findings, developed and tested patches, and decided how the information should be shared. OpenAI says it is not aware of attackers finding the flaws first, but that is the company’s assessment — not proof that nobody else knew about them.
The case illustrates responsible vulnerability disclosure. Publishing technical details before a fix exists can give attackers the same knowledge. Affected developers and providers are therefore given time to close the gap and prepare updates before the full finding becomes public.
For website owners, the advice is undramatic but important: check which PHP version your hosting provider uses, follow official guidance from the provider and the PHP project, and keep both the web platform and its extensions current. Do not try to interpret or test exploit code on a live website yourself.
Our editorial takeaway: the encouraging part is not only that AI can find flaws faster. Here, it was placed inside a process where people retained control of validation, remediation and disclosure. The future of digital security will depend as much on good coordination as on capable models.