OpenAI discloses that GPT-5.6 Sol found two high-severity vulnerabilities in PHP

OpenAI Uncovers Fatal PHP Vulnerabilities! 70% of Websites Worldwide Hit by Late-Night Explosion Xinzhiyuan, October 22, 2026, 06:34:13, from Beijing | Updated October 22, 2026, 07:15:05

Something big has happened!

Without even needing an account or password, hackers may be able to make website servers do their bidding!

Just moments ago, OpenAI publicly disclosed a thrilling behind-the-scenes operation: GPT-5.6 Sol dug out two critical vulnerabilities from PHP, the language used by 70% of websites worldwide.

Once exploited, attackers don't even need to enter an account or password—they can directly make servers obediently execute malicious code.

Even the Dutch national cybersecurity agency, which normally teaches others how to defend against hackers, reacted to the news by immediately shutting down its own official website!

To plug the holes, OpenAI and PHP maintainers secretly battled for two months, willing to tear everything down and start over—even changing the PHP engine's memory management mechanism.

Yet after two months of secrecy, everything collapsed in the final 48 hours—

The vulnerability news leaked first, forcing the patch to go live a day early; then an attack demonstration video accidentally leaked, and the fixed images were made public ahead of schedule.

Before webmasters worldwide could react and apply patches, the first wave of real attacks was already underway.

What's even more chilling is that OpenAI casually buried an easter egg: these two are just appetizers—several other major vulnerabilities are still queued up for emergency repair...

Three points to understand this PHP blowup:

Two high-severity vulnerabilities: PHP is a common backend language for websites. In affected deployments, attackers may be able to make servers execute malicious code without logging in.

GPT helped find the holes: Calif used GPT to discover the vulnerabilities, and Wiz independently found them as well; PHP maintainers led the fix, with OpenAI coordinating all parties.

Patches have been released: website operators need to upgrade PHP; temporary protections cannot replace patches.

PHP Suddenly Blows Up, Cybersecurity Agencies Shut Down Sites First

In this secret emergency repair, even the agencies responsible for defending against hackers had to shut down their sites first to avoid risk. Before the patches arrived, the official websites went offline first.

On October 21, the Dutch National Cyber Security Centre (NCSC) chose to shut down its site first and wait for the fix.

It wasn't the only one. The Dutch judicial system's recruitment website and judicial training institute website also suspended service, and even the document mailbox used to transmit court hearing information to journalists was temporarily closed.

Japan's Ministry of Finance likewise suspended some content and services on its official website, urgently inspecting servers and installing fixes.

The two PHP engine vulnerabilities that triggered the shutdowns are collectively called PHP2Shell, both with a CVSS severity score of 9.2 out of 10.

The most dangerous consequence is called remote code execution, or RCE. A website is supposed to only handle requests sent by visitors, but it may end up executing code specified by an attacker.

Wiz built a test environment using the latest WordPress, Drupal, and Joomla images at the time, reproduced a remote attack requiring no login, and also verified an attack path for reading passwords, tokens, and API keys from memory.

Even more, in some Apache with mod_php deployments, the attack can occur before the website's own program even starts. Even if a page contains only a single line of "Hello World," it could be affected.

The trouble is that there are simply too many websites using PHP. Among websites whose server-side language W3Techs can identify, 69.3% use PHP. When the underlying engine has a problem, a large number of websites must be checked and upgraded accordingly.

GPT Does Great Work

From One Vulnerability to an Entire Class

Rewind to July 30, when Calif researcher Ryan Austin began auditing PHP. He was participating in OpenAI's Patch the Planet program, which uses AI to help open-source projects find and fix vulnerabilities.

By August 1, multiple remote attack paths had been found.

As early as 2004, PHP's memory limit mechanism was found to have a remote attack vulnerability. Ryan had GPT-5.6 Sol use this as an entry point to check whether similar problems were still hidden in the existing code.

When a program handles a request, it must temporarily place data in memory. PHP sets a quota for each request, and when it's used up, processing must be interrupted. This situation is called memory exhaustion, or OOM.

In one attack path disclosed by Calif, less than 8 MiB of request data was enough to exhaust PHP's default 128 MiB memory quota during processing.

When a small request enters PHP, it is split into a large number of records, each requiring extra memory. Attackers exploit this amplification layer to make the program exhaust its quota at a specific step.

According to PHP's rules, at this point the operation should be interrupted and switched to error reporting and cleanup.

But it is precisely at this moment that the data may be only half filled in.

The model found a dangerous ordering in the hash table where PHP stores data internally: when adding a new record, it first increments the record count, and only then allocates memory and fills in the content.

If the memory quota happens to be exhausted during allocation, the program jumps away. The new record hasn't been filled in yet, but the count has already been incremented.

When the cleanup routine checks against the count, it treats the not-yet-prepared memory as a valid record. It's as if a row in a table hasn't been fully filled in, yet it's already being used as a complete record.

Turning this kind of error into a remote attack also requires arranging the relevant memory contents and satisfying specific runtime conditions. Researchers have already made the program execute attacker-specified code in affected deployments.

The researchers didn't stop at this hole. They had the model write the error pattern it had just discovered into SKILL.md, a reusable audit guide, and then followed the same thread further.

With that, the Agent found another problem in the code responsible for tracking file upload progress.

A request ended abnormally and the memory was freed, but the program handling the request still kept the old address. When it received the next request, it might use that address to read memory that had already been invalidated.

This is use-after-free, also called UAF. It's like a registration that has already been voided, yet the program still looks up data according to the old address, and that memory may already have been reallocated.

On the other side, Wiz also independently found two vulnerabilities. Once the PHP version changes and the runtime environment changes, the original attack may stop working, and the model still has to analyze the crash and adjust its verification.

Wiz researcher Sagi Tzadik wrote on X: "AI did most of the work here."

Operating on the PHP engine

Two months of secret emergency repairs

It took only a few days to find the attack path, but the repair preparations that followed kept them busy for two months.

This time OpenAI led the coordination, with PHP maintainers leading the fix. But the two vulnerabilities involved the engine's memory management and error handling; blocking the immediate attack path might still leave similar problems emerging elsewhere, while a major overhaul of the underlying layer would also have to ensure that old programs and extensions still run.

The PHP Foundation said the team coordinated around the clock, even on weekends. Patches had to be tested across multiple versions, and distributors had to package them while security vendors prepared protections.

In the end, PHP even changed when it aborts work.

After the fix, PHP set two memory limits. When the soft limit is reached, it waits until the program reaches a safe point before handling it, avoiding leaving half-finished data; when the higher hard limit is reached, it exits the process, preventing the dangerous state from continuing to be used.

The last 48 hours brought leak after leak, and the attacks came first

All parties had originally agreed to release together at 10 p.m. on October 22.

But around 11 p.m. on the 20th, the numbers of the two vulnerabilities suddenly circulated online, mixed with an incorrect release time and a score of 10 out of 10. At that point, there was less than 48 hours until the scheduled release.

At 3:30 a.m. on the 21st, the PHP team issued an advance notice and moved the official release forward by a full 24 hours.

But sending a notice doesn't mean the update can be installed. Distributors were still packaging; moving it any earlier would mean users would first learn they were in danger but couldn't get an easily installable update.

About half an hour after the notice was sent, the attack demonstration video also leaked.

The PHP Foundation said in its review that Calif had mistakenly released the attack demonstration. The video was quickly deleted, but copies had already spread.

By the afternoon of the 21st, even build images containing the fix had been made public early. After Chainguard released these images, outsiders could already compare the old and new code and infer where the vulnerabilities were.

At 3:43 p.m. that same day, Cloudflare Chief Technology Officer Dane Knecht posted on X: early attacks had already been seen.

When he posted, the patch wasn't scheduled for unified release until 10 p.m. that night. The attacks had already begun, and there were still more than six hours to hold out.

Cloudflare later also disclosed that attackers were already modifying requests to try to bypass protection rules.

Cloudflare deployed protection for free and paid customers using its Web Application Firewall, but Dane stressed that this was only a temporary measure and that the patch had to be installed once it came out.

On the evening of the 21st, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were finally released. The PHP team also prepared minimal source patches for 7.4, 8.0 and 8.1, for distributors and long-term support services to produce update packages.

OpenAI's advance notice

More major vulnerabilities are still to come

At 12:35 a.m. on the 22nd, OpenAI released another Codex inspection skill to help website operators check their PHP version and determine whether they might be affected.

It checks the PHP version and cannot upgrade a website on its behalf; if even the version cannot be determined, that also cannot be taken as proof of safety.

And OpenAI has already given advance notice: PHP is only one of multiple major vulnerabilities the team has discovered and is fixing.

In the coming months, discoveries of this kind are expected to increase significantly!