OpenAI and Google AI Discover Critical PHP Vulnerabilities Affecting 70% of Websites
Two decade-old flaws in widely-used programming language prompt urgent global patching efforts
OpenAI, Google-owned Wiz, and cybersecurity startup Calif announced Tuesday that artificial intelligence systems discovered two critical vulnerabilities in PHP, the web programming language that underpins approximately 70% of websites on the internet.
“We consider this one of the most impactful security issues in recent memory,” OpenAI wrote in a blog post announcing the findings.
The vulnerabilities, which researchers say have existed in PHP code for over a decade without being exploited, could allow hackers to install malware on vulnerable web servers or steal sensitive customer data. Website owners worldwide are now scrambling to deploy patches.
Government agencies including the FBI and the U.K.’s GCHQ are urging organizations to apply security fixes as soon as possible. Some European governments have taken the extraordinary step of taking their websites offline entirely while they patch the flaws.
AI Models Used to Uncover and Attack Flaws
Researchers at OpenAI, Calif, and Wiz employed a combination of OpenAI’s GPT-5.6 Sol and Google Gemini 4 Argon models to both identify and exploit the vulnerabilities. The collaboration marks a significant moment in cybersecurity, demonstrating that AI systems are increasingly matching or exceeding human hackers at finding software weaknesses.
The discovery highlights growing concerns about the dual-use nature of advanced AI models—capable of both defending and attacking digital infrastructure. Security experts note that while AI-powered vulnerability detection can help organizations patch flaws faster, the same capabilities could be leveraged by malicious actors.
PHP’s Critical Role in Web Infrastructure
While languages like HTML and CSS handle the visual elements of websites, PHP operates behind the scenes—managing user authentication, processing payments, and handling other sensitive functions that power everything from e-commerce platforms to content management systems.
The widespread adoption of PHP means the vulnerabilities have potentially far-reaching implications for internet security. Researchers have not disclosed specific technical details about the flaws, a standard practice designed to give organizations time to patch before attackers can exploit them.
Race to Patch
The disclosure has triggered a global patching effort, with system administrators working to update affected servers before exploits can be developed. The involvement of multiple government cybersecurity agencies underscores the severity of the threat.
The collaboration between OpenAI, Google’s Wiz, and Calif represents an unusual partnership between competing AI companies and security firms, suggesting the industry is beginning to coordinate more closely on identifying and addressing critical infrastructure vulnerabilities.
Representatives from OpenAI, Google, and Calif did not immediately respond to requests for additional comment on the technical nature of the vulnerabilities or the specific timeline for full patching across affected systems.
About The Author
