Security/press release/2026-10-20

Critical PHP Vulnerabilities Discovered by AI Models Lead to Widespread Patching Efforts

Multiple critical vulnerabilities in the widely used web programming language PHP have been discovered, prompting an urgent global response to issue and apply patches. These flaws, collectively referred to as "PHP2Shell" by some, pose a significant security risk to a large portion of the internet. The discovery led to some government websites, including those in the EU and Canada, being temporarily taken offline as operators addressed the issues. OpenAI, in collaboration with Google's AI division Wiz, claims its advanced AI models, specifically GPT-5.6 Sol and Gemini 4 Argon, were instrumental in identifying these long-standing vulnerabilities. OpenAI stated that this was potentially one of the most impactful security issues in recent memory and coordinated a "Patch the Planet" initiative. While the AI's role in discovery is a first-party claim from OpenAI and Wiz, the widespread impact and patching efforts are broadly reported.

27 articles from 25 outlets covered this story. Their coverage differs on 2 points. The underlying claim is sourced from a press release.

What do all outlets agree on?

25 outlets covered “Critical PHP Vulnerabilities Discovered by AI Models Lead to Widespread Patching Efforts”. All of them report the following:

  • Critical PHP vulnerabilities were discovered
  • These vulnerabilities affect a significant portion of the internet
  • AI models are credited with the discovery
  • Emergency patches are being issued and applied
  • Some government websites (e.g., EU, Canada) were taken offline
  • OpenAI coordinated a global response

Did outlets disagree about this?

Yes. Coverage of “Critical PHP Vulnerabilities Discovered by AI Models Lead to Widespread Patching Efforts” differs on 2 points. Each account below is how a different outlet described the same event:

The primary AI model responsible for the discovery

Decrypt (ChatGPT), Mashable SEA (GPT-5.6 Sol), the-decoder.com (GPT-5.6 Sol and Gemini 4 Argon)

The overall severity and impact of the vulnerabilities

Wired ('setting the Internet on fire'), Business Insider Tech ('causing internet chaos'), Engadget ('putting site admins on edge')

Which figures do outlets report differently?

1 figure in this story is reported with conflicting values:

Percentage of internet affected70% vs millions of websites vs widespread

Which outlets covered this?

All 27 articles found on this story, grouped by the stance of the piece. Every link goes to the original publisher.

safety16
Websites go dark worldwide as AI exposes critical security flawsSouth China Morning Post — Tech · general news

What related stories are there?

Which companies does this involve?

Get the week in AI in one email

What happened, which outlets reported it, and where their coverage differed. One issue a week.

The first issue hasn’t gone out yet. Subscribe and it’s the one you’ll get.

We’ll send the digest and nothing else. One-click unsubscribe. Privacy.