OpenAI model discovers major PHP security vulnerabilities, calls them one of the most impactful security issues in recent years

OpenAI announced that its safety research team Calif used GPT-5.6 Sol to audit the PHP codebase and found two critical vulnerabilities allowing unauthenticated remote code execution (RCE); Google's Wiz independently discovered the same issues. On October 21, PHP urgently released four fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35; the vulnerabilities are collectively called "PHP2Shell," with a CVSS v4.0 score of 9.2, and affected versions range from 5.4 to 8.5. OpenAI said this may be one of the most impactful security issues in recent years, and proposed the concept of a "defender's window," referring to AI discovering vulnerabilities before attackers and buying time for fixes. Vulnerability information leaked the day before disclosure; Cloudflare said it had observed early signs of exploitation before the patch was released, and watchTowr said it had observed actual exploitation via honeypots on October 21. CISA and other national agencies urgently urged patching, the Wikimedia Foundation shut down a large number of services, and several Japanese games temporarily suspended service.