AI-discovered PHP flaw forces emergency patching across the web

Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers.

SITUATION DETECTED: Critical PHP vulnerabilities were discovered with the help of GPT-5.6 Sol. OpenAI says these are among several significant vulnerabilities they have found and are working to fix, and they expect similar findings to "increase sharply" in the coming months.

That PHP vulnerability that’s gonna cause havoc this week was found with… GPT‑5.6 Sol.

OpenAI says the PHP security flaw (found with GPT-5.6 Sol) is the tip of the iceberg, and they have several more discoveries to announce.

Companies I talk to are struggling with the rate of patches they need to do thanks to AI defenses finding issues before the inevitable wave of incoming cyberattacks by other AIs. Now consumers are going to have the same experience of getting everything updated often & fast.

📝 Towards securing the internet My first programming language was PHP. I remember discovering the joy of creating software while learning to build in such a beginner-friendly and accessible language. That's one reason I've felt a deep personal connection to the work that our team has been doing to secure PHP. Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell. It was discovered and addressed using our models as part of our Patch the Planet initiative. This vulnerability allows any attacker to execute code on nearly all deployed PHP application, effectively allowing them to exfiltrate private user data or modifying the site however they want. The bug has been present in PHP for 14…

Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server. tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible. The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading…

AI systems found a working server takeover exploit in PHP, one of the most critical cybersecurity issues in recent memory! - The vulnerability was found using a mix of OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon, plus human expertise - PHP is the programming language behind ~70% of websites, most notably Wordpress - The bugs sit in PHP itself, so nearly every PHP site is exposed no matter how well its own code is written. Merely running PHP itself is the risk - The vulnerability lets an attacker with no login either run code on a server or read its memory, which can hold passwords, session tokens, API keys, or other secrets - The flaw is from from how PHP cleans up when a request crashes after running out of memory: corrupted state is left behind and the next request can pick it up.…

If you are wondering whether your website is affected, we have packaged a Codex skill to help check. Point your Codex at this repo to guide you through it: