AI found flaws in the code behind 70% of the web. The fix took two months.

PHP powers around three-quarters of websites on the internet, making a flaw in its core engine a serious issue. Researchers recently discovered two critical vulnerabilities, dubbed PHP2Shell, which allow attackers to access sensitive data or execute malicious code. These vulnerabilities, with CVSS scores of 9.2, were found using frontier AI models from OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon.

The flaw lies in how PHP handles errors, potentially leaving behind invalid memory references that can be exploited by attackers. Wiz discovered the vulnerabilities using its Wiz Atlas tool alongside Gemini and GPT models, while Cloudflare also identified the bugs. The issue stems from PHP's memory-safety bugs, such as use-after-free and type confusion, which have been difficult to prevent due to the language being written in C. Exploiting these flaws required a series of weaknesses, but AI models like GPT-5.6 Sol made it easier to create functional exploits.

Researchers found that these vulnerabilities affected all PHP releases from the past decade, with some code dating back to PHP 5.4. Wiz discovered the first flaw on August 19 and confirmed unauthenticated code execution against Drupal the next day. The patches were released on September 21, nine hours before the public disclosure, with Cloudflare leading the protection efforts.

OpenAI has proposed a new framework for handling security flaws discovered by AI, emphasizing the need for a collaborative approach between maintainers, researchers, and essential technical partners.