The alarm began with an AI-assisted hunt for weaknesses in PHP, the open-source language woven into a vast share of the web. OpenAI said a researcher at Calif used GPT-5.6 Sol to identify the critical exploits before attackers, then released a tool intended to help developers identify vulnerable PHP versions.¹

The stakes became clear as researchers described what the flaws could enable: attackers could seize vulnerable web servers without passwords, opening a path to stolen data, altered sites and broader disruption. PHP is used by nearly 70% of websites, while Wiz researchers called the findings “among the most severe vulnerabilities discovered in PHP, and arguably in software history.”² The discovery also sharpened a long-running divide in cybersecurity. OpenAI cast AI as a defensive force capable of finding bugs humans missed; security professionals warned that the very same capability can compress the time between disclosure and exploitation.

By Wednesday, that theoretical danger had become an operational crisis. Governments and organizations in Europe and the United States temporarily took websites offline while rushing through security updates.³ Website operators faced an ugly choice: accept downtime and patch immediately, or remain online while exposed to a flaw that could hand over control of their systems.

The public disclosure then triggered urgent warnings from officials worldwide, including Japan’s prime minister, while Cloudflare CTO Dane Knecht said “early attacks” were already emerging and mitigations were being updated as new vectors appeared.⁴ For defenders, finding the bug first was a crucial advantage. The scramble to contain it shows how narrow that advantage may be when AI accelerates both sides of the security race.⁵