Found by a Machine
The most serious PHP flaw in over a decade was discovered not by a hacker but by an AI model: OpenAI's GPT-5.6 Sol. Websites worldwide, including the University of Vienna and TU Wien, went offline as a precaution.
On 21 October 2026, PHP released emergency updates for two critical flaws that let attackers run their own code on servers. PHP is estimated to power around 70% of all websites [1]. Within hours, Cloudflare counted millions of attack attempts, and numerous institutions took their sites offline, in Austria among them the University of Vienna, TU Wien and the newspaper NÖN [2].
The flaws were found with AI. In August, the security company Calif came across them using OpenAI’s GPT-5.6 Sol model as part of OpenAI’s “Patch the Planet” programme. Wiz independently found them as well, using GPT-5.6 Sol and Google’s Gemini among other tools [3]. The bug had been sitting in the code for more than a decade.
Peter Steinberger, creator of OpenClaw and now at OpenAI, summed it up in one sentence on X: the vulnerability that was going to cause havoc this week had been found with … GPT-5.6 Sol.
OpenAI itself speaks of a new phase in which AI can find security flaws with internet-scale impact [1]. The model’s name now takes centre stage as naturally as the name of the researcher who reported a flaw once did.
Sources
This indication by Benedikt Brünner is licensed under
CC BY 4.0
Comments 0
Comments are moderated. New comments appear after review by the editors.
No comments yet.