OpenAI and Google's Wiz uncover PHP flaws using AI

In October 2026, OpenAI and Google's Wiz team separately used AI tools to uncover multiple critical vulnerabilities in the PHP programming language, with patches issued by the PHP Foundation. The U.S. National Security Agency (NSA) subsequently warned that the flaws have broad impact and advised website operators to take sites offline if they cannot be patched immediately.

Security testing company Calif, working under OpenAI's "Patch the Planet" initiative, used GPT-5.6 Sol to discover one of the flaws. The Wiz team used its Wiz Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol to find multiple PHP vulnerabilities. Both organizations followed responsible security research practices, coordinating with the PHP team on patches before public disclosure.

PHP is a widely used server-side programming language that powers roughly 70% of websites on the internet. The vulnerabilities exist in all versions of PHP since version 5, released in 2004. OpenAI said the flaws were found by researchers before hackers discovered them, with no reports of exploits in the wild. Wiz noted in a blog post that these flaws were previously too difficult for hackers to exploit, but AI has removed that technical barrier.