Millions of websites could face security risks as OpenAI has discovered a critical vulnerability in PHP, a programming language widely used to run websites. The discovery has raised concerns about the security of online services, as attackers can exploit such flaws to access sensitive information or affected systems. OpenAI said its AI model, GPT-5.6 Sol, identified the issue as part of its cybersecurity efforts. Security company Wiz also independently discovered and reported two vulnerabilities affecting PHP. The companies worked with developers and other technology firms to address the issues before publicly sharing the details.
OpenAI said the flaw was discovered by its researcher, Calif, under the company’s Patch the Planet initiative. Over the past two months, it worked with PHP developers, security researchers and technology companies, including Wiz and Cloudflare, to address the vulnerabilities. The collaboration aimed to address the security problems before making them public.
PHP is used by millions of websites and online services. Vulnerabilities in the software can put systems at risk if they remain unpatched. Depending on the flaw, attackers could gain access to important files, databases or other sensitive information.
While AI tools can help security researchers find software vulnerabilities faster, OpenAI has warned that attackers could use similar technology to develop cyberattacks. As AI models become more capable, they may uncover more security weaknesses in widely used software.
The company expects the number of such discoveries to increase in the coming months. It has also committed $1 billion in subsidised access to its Daybreak AI capabilities through an initiative called Daybreak for Frontline Defenders. The programme aims to help cybersecurity professionals strengthen their defences.
The NSA Cyber division of the US National Security Agency has also highlighted the seriousness of the vulnerabilities. It advised organisations using PHP to prepare for updates that address two critical security issues.
It said, “PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommended that organisations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.”
If you are wondering whether your website is affected, we have packaged a Codex skill to help check. Point your Codex at this repo to guide you through it: https://t.co/XUEbOwXuQC
— OpenAI (@OpenAI) October 21, 2026
OpenAI has shared a PHP version-checking tool as a Codex skill. It can help website operators identify potentially vulnerable versions of PHP and determine which security updates they need, using guidance from PHP developers and their service providers.
For organisations running PHP-based websites, applying the relevant security updates should be the priority.