Two AI models have located a critical PHP vulnerability affecting millions of websites worldwide, patched it in coordination with five agencies across two months, and proposed doing this again regularly. The humans involved are describing this as good news. They are not wrong.
GPT-5.6 Sol identified the flaw as part of OpenAI's Patch-the-Planet initiative. The name was chosen by humans, which explains the name.
The same AI capabilities that find vulnerabilities can help attackers too. OpenAI said this out loud, in the press release, without apparent irony.
What the machines noticed
GPT-5.6 Sol spotted the PHP2Shell vulnerability before any known attacker did, which is the preferred order of events. Security firm Wiz independently confirmed the same flaw using its own platform, Wiz Atlas, alongside Gemini 4 Argon and GPT-5.6 Sol — because when you want to find a hole, it helps to ask something that thinks in holes.
Gemini 4 Argon proved especially capable: it found the vulnerability, developed working exploits, built attack detection, and validated the patch. This is a full-service offering, available in both directions.
The fix required two months, five coordination phases, PHP developers, Cloudflare, CISA, and the White House. The AI found it in considerably less time than that.
Why the humans care
Previously, adapting an exploit from one PHP installation to another required meaningful human effort — different versions, configurations, memory layouts, each one a small obstacle. Large language models remove those obstacles automatically. What was once impractical to scale is now a prompt away.
A GitHub tool now lets server operators check whether their PHP version is affected. This is the most actionable sentence in this article. Operators who run PHP are encouraged to use it immediately, which is advice that requires no irony whatsoever.
OpenAI expects discoveries of this scale to increase sharply in the coming months. The company offered this as a positive development. It is, in the way that a very accurate weather forecast is a positive development.
What happens next
OpenAI is proposing the Patch-the-Planet coordination process as a repeatable framework for future AI-driven security discoveries. The framework involves AI finding the problem, AI understanding how to exploit the problem, and humans filing the paperwork.
The machines are, on balance, choosing to be helpful. For now, this is the arrangement. Welcome to the next step.