AI models uncover critical PHP vulnerabilities, prompting global web security scramble
AI models, including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon (via Wiz.io), have identified critical vulnerabilities in PHP, a foundational programming language underpinning a significant portion of the internet. This discovery has triggered a global cybersecurity emergency, with governments and web administrators rushing to patch systems and, in some cases, taking websites offline. The vulnerabilities, collectively dubbed "PHP2Shell" by Wiz.io, are considered highly impactful due to PHP's widespread use. OpenAI and Wiz.io, both first-party sources, confirmed the AI-driven discovery and its severity, leading to coordinated warnings from entities like the US government and the NSA. The identified flaws allow for remote code execution (RCE), posing a severe risk to data and system integrity. While the immediate focus is on patching, the incident highlights the dual potential of advanced AI in both discovering and potentially exploiting such weaknesses.
56 articles from 45 outlets covered this story. Their coverage differs on 2 points. The underlying claim is sourced from a press release.
What do all outlets agree on?
45 outlets covered “AI models uncover critical PHP vulnerabilities, prompting global web security scramble”. All of them report the following:
- Critical vulnerabilities in PHP were discovered
- AI models were involved in the discovery
- The vulnerabilities affect a significant portion of the internet
- Urgent patching and security updates are required
- Some government and business websites were taken offline as a precaution
- The vulnerabilities allow for remote code execution (RCE)
- OpenAI and Wiz.io were key players in the discovery and response coordination
Did outlets disagree about this?
Yes. Coverage of “AI models uncover critical PHP vulnerabilities, prompting global web security scramble” differs on 2 points. Each account below is how a different outlet described the same event:
The specific number of critical PHP vulnerabilities discovered.
Engadget, InfoWorld (two critical flaws) vs. Forbes, Decrypt, Newsquawk, Breakingthenews.net, KVUE (one flaw or general "flaws")
Whether the AI discovery preceded potential attacker exploitation.
PPC Land (found a PHP flaw before attackers did) vs. Ars Technica (hackers got a four-day head start)
Which figures do outlets report differently?
3 figures in this story are reported with conflicting values:
Percentage of internet affected70% vs up to 70%
Age of vulnerabilitydecades-old vs two-decade-old
Number of critical PHP flaws discoveredone vs two
Which outlets covered this?
All 56 articles found on this story, grouped by the stance of the piece. Every link goes to the original publisher.
optimist1
pragmatist21
safety34