AI Discovers Critical PHP Vulnerability

AI models from OpenAI and Google have independently discovered a critical PHP vulnerability that could affect millions of websites worldwide. PHP is a programming language used by many websites globally and underpins a wide range of services including blogs and corporate websites. This vulnerability is a flaw hidden in PHP that, if exploited, could expose an enormous number of sites to risk.

On OpenAI's side, a model called GPT-5.6 Sol discovered this flaw as part of its "Patch the Planet" security improvement initiative. Meanwhile, security specialist firm Wiz reported that it independently identified the same vulnerability using Google's Gemini 4 Argon. The fact that different companies using different AI models arrived at the same defect independently enhances the credibility of this discovery.

"Patch the Planet" is positioned as an initiative demonstrating a direction to actively leverage AI as a defensive tool rather than against security threats. If AI can replace and complement the vulnerability searches that security experts have conducted over long periods, it could represent a meaningful change in improving the overall security of software. However, as OpenAI itself acknowledges, this type of capability has two sides.

OpenAI warns that AI's ability to discover vulnerabilities could also be a useful tool for attackers. In other words, technology that helps defense and technology that can be repurposed for attack are the same thing, and results vary significantly depending on how they are used. This dual-edged nature is an inescapable perspective when considering AI adoption in the security field.

The significance of this discovery goes beyond the mere fact that one defect was found. If it is demonstrated that AI can find vulnerabilities at a level equal to or exceeding that of human security researchers, the division of roles in software development and operations may change going forward. It can be argued that a future where AI security diagnostics become a routine process is not far away.

On the other hand, if the same capability falls into the hands of malicious actors, it could lead to more efficient attacks and expanded scope. If AI significantly lowers the cost of vulnerability discovery, it could create situations where competition between defenders and attackers proceeds at an even faster pace than before. It is positioned as an important future task for the entire security community to establish rules for AI utilization and methods of information sharing.

In this case, how the discovered vulnerability is addressed and remediated is a point that warrants continued attention. Whether AI can contribute not only to discovering defects but also to the remediation process is a metric by which to measure the practical value of AI adoption in the security field.