The biggest PHP security issue in years was found by an AI model before human attackers did
Frontier models now find internet-scale bugs faster than humans do, which means the patching clock is set by whoever runs these models first.
OpenAI then ran a two-month coordinated response with PHP maintainers, Cloudflare, and CISA before disclosing it.
OpenAI’s GPT-5.6 Sol found a critical PHP vulnerability, and Wiz found it independently. PHP runs most of the web. Patches shipped this week, and alongside them OpenAI released a PHP version checker and committed $1B in subsidised security access for frontline defenders. It says it expects AI-found bugs to increase sharply.
My read: frontier models now find internet-scale bugs faster than humans do, which means the patching clock is set by whoever runs these models first.
Your pick: if PHP runs anywhere in your stack, check the version and patch now. Then add AI-assisted security review to your workflow before your adversaries do.
12 months: AI-found CVEs are routine in major open-source projects.
24 months: coordinated disclosure with AI labs is standard practice.
36 months: shipping code without AI security review looks negligent.
Why I may be wrong: finding a bug and getting the world to patch it are different problems. Most sites won’t patch, and attackers get the same models.
Is your stack patched, or just not breached yet?