Researchers using GPT-5.6 Sol found massively critical flaw in PHP, which runs about 70% of websites, knocked major sites offline as operators rushed to patch.
Calif, an AI security firm, who found this, said in a statement that the vulnerabilities could put 70% of the world’s websites at risk if they aren’t patched quickly, and called them “the most severe vulnerabilities ever discovered by AI, if not in all of software history.”
PHP rushed out fixes as it could let attackers without accounts take over web servers.
Both bugs score 9.2 on the CVSS severity scale and affect PHP versions as old as 5.4.
When a request hits PHP’s memory cap at the wrong moment, PHP frees memory but keeps pointers to it, which a later request on that worker can hijack.
Auditors spotted the weakness in 2024, but the fix stalled for months, partly because nobody had shown a practical attack.
Wiz, a cloud security company, now owned by Google, says the models let one researcher finish in a week what once took a top team months.
A leak of the CVE numbers forced PHP to ship a day early, and Cloudflare now reports early attack attempts.