OpenAI's models uncover critical PHP flaws used by most websites

OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors. Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can…

Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers.

SITUATION DETECTED: Critical PHP vulnerabilities were discovered with the help of GPT-5.6 Sol. OpenAI says these are among several significant vulnerabilities they have found and are working to fix, and they expect similar findings to "increase sharply" in the coming months.

That PHP vulnerability that’s gonna cause havoc this week was found with… GPT‑5.6 Sol.

OpenAI says the PHP security flaw (found with GPT-5.6 Sol) is the tip of the iceberg, and they have several more discoveries to announce.

Companies I talk to are struggling with the rate of patches they need to do thanks to AI defenses finding issues before the inevitable wave of incoming cyberattacks by other AIs. Now consumers are going to have the same experience of getting everything updated often & fast.

📝 Towards securing the internet My first programming language was PHP. I remember discovering the joy of creating software while learning to build in such a beginner-friendly and accessible language. That's one reason I've felt a deep personal connection to the work that our team has been doing to secure PHP. Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell. It was discovered and addressed using our models as part of our Patch the Planet initiative. This vulnerability allows any attacker to execute code on nearly all deployed PHP application, effectively allowing them to exfiltrate private user data or modifying the site however they want. The bug has been present in PHP for 14…

Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server. tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible. The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading…

AI systems found a working server takeover exploit in PHP, one of the most critical cybersecurity issues in recent memory! - The vulnerability was found using a mix of OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon, plus human expertise - PHP is the programming language behind ~70% of websites, most notably Wordpress - The bugs sit in PHP itself, so nearly every PHP site is exposed no matter how well its own code is written. Merely running PHP itself is the risk - The vulnerability lets an attacker with no login either run code on a server or read its memory, which can hold passwords, session tokens, API keys, or other secrets - The flaw is from from how PHP cleans up when a request crashes after running out of memory: corrupted state is left behind and the next request can pick it up.…

If you are wondering whether your website is affected, we have packaged a Codex skill to help check. Point your Codex at this repo to guide you through it:

⚠️ Vulnerability alert: php2shell Unpatched sites running PHP 5.4 or later are at risk of remote code execution, data exposure, and crashes. If your site’s web traffic is proxied through Cloudflare, we deployed protections before official public disclosure. Check the blog post to see which mitigations are enabled by default. Even with these mitigations in place, update PHP as soon as possible to fix the underlying vulnerabilities.

A founder built a SaaS making $100K a year in profit by helping people track their daily habits. And it's been around since 2013! The app helps people track everything from sleep and exercise to mood, productivity and personal goals. Pretty simple idea with some impressive numbers. > $118K TTM revenue > $100K TTM profit > $105K ARR > 1,000+ customers > 85% profit margins All bootstrapped. More than a decade of building a profitable business around helping people understand their own lives. Love businesses like this. Now live on @acquiredotcom. Full listing: