PHP discloses critical "php2shell" bugs found with GPT-5.6 Sol

The disclosure caps a coordinated effort that began in August, when multiple security organizations independently found parts of the same flaw. Calif, an AI red-teaming firm invited into OpenAI's Patch the Planet initiative, found the first issue on Aug. 1 using GPT-5.6 Sol. OpenAI then investigated on its own and found additional elements, making the flaw appear more serious than Calif had originally realized. Through conversations with the PHP Foundation, OpenAI learned that Wiz, a Google-owned cybersecurity company, was also talking to the foundation about the issue. Wiz researchers had independently found the vulnerabilities on Aug. 19 using a combination of Google's Gemini 4 Argon, OpenAI's GPT-5.6 Sol, and Wiz Atlas. OpenAI then brought the parties together into a coalition that included Wiz, Calif, PHP, Cloudflare, and multiple U.S. government agencies, with Cloudflare's blog post also naming the French cybersecurity company Quarkslab. As reports broke overnight ahead of the patch's official release, Cloudflare's CTO Dane Knecht said the company began seeing "early attacks." One startup owner reported that hackers allegedly stole their source code, exposed cookie data, and leaked legal documents. Governments including some agencies in the Netherlands and Finland took websites offline as a precaution, Reuters reported, while the FBI's cyber division, the National Security Agency, Japan's prime minister, and the European Union's computer emergency response team urged affected organizations to update.