---
title: Found by a Machine
author: Benedikt Brünner
date: 2026-10-23
url: https://postgenerative.at/indications/2026-10-23/found-by-a-machine
lang: en
type: Indication
summary: "The most serious PHP flaw in over a decade was discovered not by a hacker but by an AI model: OpenAI's GPT-5.6 Sol. Websites worldwide, including the University of Vienna and TU Wien, went offline as a precaution."
tags:
  - Software
  - Open source
  - Security
sources:
  - title: OpenAI auf X, 21.10.2026
    url: https://x.com/OpenAI/status/2112907856018309586
  - title: "ORF.at: PHP-Lücke: Millionen Angriffsversuche im Netz"
    url: https://orf.at/stories/3445806/
  - title: "The Next Web: PHP rushes out emergency patches for two critical bugs AI found first"
    url: https://thenextweb.com/news/php2shell-php-rce-ai-openai-wiz
license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)
alternate:
  de: https://postgenerativ.at/indizien/2026-10-23/gefunden-von-einer-maschine
---

# Found by a Machine

On 21 October 2026, PHP released emergency updates for two critical flaws that let attackers run their own code on servers. PHP is estimated to power around 70% of all websites [1]. Within hours, Cloudflare counted millions of attack attempts, and numerous institutions took their sites offline, in Austria among them the University of Vienna, TU Wien and the newspaper NÖN [2].

The flaws were found with AI. In August, the security company Calif came across them using OpenAI's GPT-5.6 Sol model as part of OpenAI's "Patch the Planet" programme. Wiz independently found them as well, using GPT-5.6 Sol and Google's Gemini among other tools [3]. The bug had been sitting in the code for more than a decade.

Peter Steinberger, creator of OpenClaw and now at OpenAI, summed it up in one sentence on X: the vulnerability that was going to cause havoc this week had been found with … GPT-5.6 Sol.

https://x.com/steipete/status/2112913060709228764

OpenAI itself speaks of a new phase in which AI can find security flaws with internet-scale impact [1]. The model's name now takes centre stage as naturally as the name of the researcher who reported a flaw once did.