Security researchers using an OpenAI model have uncovered two stunning security flaws in PHP, the software that underpins nearly 70 percent of all websites on the internet.
The flaws are so catastrophic that all websites using PHP — all untold millions of them — are advised to immediately take their servers down and apply the latest patch, which was released Wednesday. Vast swathes of the internet, following the news, have gone dark. Some that went offline for a time include Wikipedia, Steam, and even government websites.
Many organizations, however, may not have the time, resources, and personpower to swiftly implement the patch, making them potential sitting ducks until they do. According to the New York Times, the information released on the vulnerability can be used to reverse engineer the attack and take control of victim’s servers and steal information. The best course of action if you can’t patch your website, the National Security Agency advised, is dramatic: keep your site offline and don’t turn it back on.
Just as extraordinary as the breadth of the threat was how it was identified. The flaws were discovered by researchers at the cybersecurity firm Calif by using OpenAI’s GPT-5.6 Sol model, as part of a collaboration with the AI company. It then reported the flaw to the PHP Foundation back on August 11.
