OpenAI model helps researchers uncover severe PHP flaws affecting most websites

Researchers have found severe security flaws in PHP, the open-source scripting language behind about 70% of the world’s websites. They found them with help from an OpenAI model. The vulnerabilities, collectively dubbed PHP2Shell, have been described as potentially among PHP’s most severe in over a decade. Some have compared the episode to Heartbleed. What the researchers found The flaws surfaced during an audit carried out in August 2026 by researchers at Calif, a security firm. The team used GPT-5.6 Sol, one of OpenAI’s models, to comb through PHP’s code. Ryan Austin of Calif is credited with discovering the vulnerabilities. The bugs allow remote code execution and control over server memory. Put simply, an attacker sitting anywhere on the internet could make a server run instructions it was never supposed to run. According to the research findings, the flaws could expose sensitive data belonging to site visitors. They could also serve as a foothold for further cyber attacks against other systems. How the disclosure unfolded Calif CEO Thai Duong alerted Volker Dusch, who works on PHP, on August 11. That started a quiet, coordinated effort to fix the problem before attackers could ...