AI Found Two Critical Flaws in the Code Behind 70 Percent of Websites

The patch everyone is scrambling to install

PHP, the programming language behind about 70 percent of websites, just pushed patches for two critical flaws found with help from OpenAI GPT 5.6 Sol. The Rundown reports OpenAI worked alongside the PHP maintainers for two months, and calls the find one of the most impactful security issues in recent memory.

Morning Brew adds the scale of the response. The PHP Foundation rated both flaws at CVSS 9.2 out of 10, the fix took more than 10,000 lines of code, and the National Security Agency urged anyone who cannot patch right away to pull systems offline.

How the flaws were found

Security firm Calif found the first bug on August 1 using GPT 5.6 Sol. Wiz, the Google owned security firm, separately caught both flaws weeks later using Sol and Gemini 4 Argon. Multiple teams using AI found the same decade old bugs independently, which says something about how thoroughly models can now read old code.

Morning Brew reports the bug had actually been flagged years ago, but it was ranked low priority because it was deemed too complicated for a human hacker to untangle by hand. AI changed that math. What once took too long to exploit can now be worked out in hours or seconds, so the defenders had to move first.

What an attacker could do with them

The flaws let hackers hijack servers with no login at all. The NSA warning, quoted in the coverage, says these vulnerabilities often provide a direct path to a server file system or database. Morning Brew lists what that means in practice:

• Alter a website content or appearance without the owner knowing
• Run their own code on the server that hosts the site
• Steal data stored on that server, including customer records

Governments took sites offline rather than wait

The response shows how seriously officials took it. Governments in Finland, Germany, and the Netherlands pulled websites offline, and Cloudflare said it was seeing early attacks emerging. Gaming and community services listed in the coverage went down or into maintenance, and 4chan went temporarily read only while awaiting the urgent PHP update.

Wiz cofounder Ami Luttwak, quoted by Morning Brew, called it the most severe AI vulnerability that was ever found. OpenAI says it has more major security finds like this still waiting to be disclosed, and describes the work as its Patch the Planet initiative, a coalition of maintainers, researchers, and security providers preparing fixes ahead of disclosure.

What to do if you own a website

Basically every WordPress site runs on PHP, and WordPress powers a huge share of small business sites, portfolios, and stores. If that is you, this is a this week task, not a someday task:

• Ask your host or developer which PHP version your site runs and whether the patch is applied
• Update WordPress, themes, and plugins, and confirm your backups are current before you update
• If your host cannot patch promptly, ask about taking the site offline briefly rather than leaving it exposed
• Turn on automatic updates where your setup allows it, so the next urgent patch is not waiting on you

The deeper lesson about old code

The uncomfortable takeaway is that code written before AI is more fragile than anyone assumed. Bugs that were safe only because they were hard to find are not safe anymore, because finding them just got cheap. The same models that create the risk are also the best tool defenders have, which is why OpenAI framed this as a race the good side won this time.

For site owners, the practical version is simple. Maintenance is no longer invisible background work you can skip. It is part of what keeps the business open.