Researchers use GPT-5.6 Sol to discover 14-year-old PHP vulnerability OpenAI

Security researchers from Calif collaborating with OpenAI used the GPT-5.6 Sol reasoning model to discover a critical zero-day vulnerability in the PHP engine that had remained undetected in source code since 2012. The discovery led to coordinated security updates across the PHP ecosystem.

The flaw impacts the core runtime powering approximately 70% of top global web properties, nearly half of which run legacy versions older than PHP 8.2. Official binary patches were released exclusively for PHP 8.2 and newer branches, while PHP 8.1 received minimal source code patches requiring manual compilation and PHP 7.4 received none. Working exploit code surfaced publicly before all downstream systems could patch, leading to immediate automated exploitation in the wild.

What it is

• AI-assisted zero-day discovery. Calif researchers directed GPT-5.6 Sol to audit the PHP codebase, identifying a flaw present since 2012.
• Ecosystem exposure. PHP powers roughly 70% of major websites, with nearly 50% running legacy releases without automatic binary patch support.
• Patch availability. Binary releases are available for PHP 8.2 and later. PHP 8.1 requires manual source recompilation; versions 7.4 and earlier remain unpatched.
• Active attacks. Proof-of-concept exploits were detected in public repositories, with malicious exploitation attempts beginning prior to widespread patch deployment.

Patch support breakdown

Sources

• OpenAI: Coordinated disclosure of critical software vulnerabilities
• PHP Group: PHP security announcements archive