Dead internet theory could soon become a reality in the literal sense. Two critical vulnerabilities in PHP, the programming language powering an estimated 70% of websites, have triggered an emergency security response. OpenAI says its GPT-5.6 Sol model helped uncover one of the flaws, highlighting how advanced models can expose weaknesses across the internet before attackers exploit them.

Both vulnerabilities received severity scores of 9.2 out of 10. PHP released emergency patches on Wednesday, October 21, following weeks of coordinated work among researchers and software maintainers. The immediate concern is whether website administrators can secure vulnerable servers before hackers turn the newly disclosed flaws into widespread attacks.

OpenAI detailed the discovery in a Wednesday blog post about its Patch the Planet initiative. The effort brought together software maintainers, security researchers and infrastructure providers to prepare fixes before public disclosure.

A self-described hacker team called Calif used GPT-5.6 Sol to identify one of the vulnerabilities. Cybersecurity firm Wiz independently discovered and reported both flaws, according to OpenAI.

PHP’s development team led the patching effort, with OpenAI, Wiz and Cloudflare contributing research and technical support. The vulnerabilities required extensive coordination because their impact could extend across countless independently operated websites and servers.

OpenAI said frontier models identified the flaws before attackers did, giving defenders time to prepare. That window matters because publishing technical details can help other researchers understand a vulnerability, but it can also give hackers a starting point.

The vulnerabilities can enable remote code execution, allowing an attacker to run malicious commands on an affected server.

Source link