GPT-5.6 Sol finds critical PHP flaw with Patch-the-Planet

The discovery did not happen in isolation. Wiz ran its own investigation using the Wiz Atlas platform alongside Google's Gemini 4 Argon and GPT-5.6 Sol, and the two efforts converged on the same set of flaws. That independent confirmation appears to have given the response its shape: the fix was coordinated over two months across five phases and drew in PHP developers, Wiz, Cloudflare, and US agencies including CISA and the White House.

OpenAI is now proposing that coordinated process as a repeatable framework for future AI-driven security discoveries. The company expects findings on the scale of the PHP2Shell flaw to increase sharply in the coming months, and it warns that the same AI capabilities that find vulnerabilities can help attackers too. Wiz's own analysis points in the same direction, noting that large language models can automatically adjust exploits across different PHP versions, configurations, and memory layouts — lowering the barrier to scaling attacks across deployments.

The episode feeds into a months-long debate over AI models' offensive and defensive cybersecurity capabilities, with the same tooling credited both for finding the flaw before attackers did and for making exploits that once seemed impractical to adapt considerably more viable.