OpenAI said Calif used GPT-5.6 Sol to identify one of two critical PHP flaws, putting AI-assisted security research in focus as maintainers prepared patches for a widely used programming language.
The PHP project issued updates Oct. 21 for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The two vulnerabilities could let attackers run code remotely without logging in, and each received a 9.2 rating under version 4.0 of the Common Vulnerability Scoring System. The project urged operators to install the fixes.
OpenAI said security firm Wiz independently found and reported both flaws. PHP maintainers led the repairs and release, the company said.
The scale of PHP use widens the potential reach of security updates. Cloudflare cited W3Techs data estimating that nearly 70% of websites with an identifiable server-side language use PHP.
Anadolu Agency reported that cybersecurity experts cited debugging and examining code structures as ways AI can help defenders. They also stressed the importance of human judgment and proper guidance.
Anthropic’s OSS Scanner offers participating open-source projects an optional fast track for findings that have not received human review. The company warns that some fast-track reports may be inaccurate and also describes reports that do undergo human review. Maintainers should validate unreviewed findings before acting. EconoTimes previously examined the review burden created by AI vulnerability detection.
The PHP project says versions 8.1 and earlier no longer receive regular updates from its team. For this release, however, its security team supplied minimal source backports for PHP 7.4, 8.0 and 8.1. Operators on older versions should check with their distribution or long-term support provider, or upgrade to a supported release.
