Key points
- OpenAI's GPT-5.6 Sol found two critical PHP flaws under its Patch-the-Planet initiative; Wiz also found them independently using Sol and Google's Gemini 4 Argon.
- Fixes were coordinated over two months in five phases with PHP developers, Wiz, Cloudflare, CISA and the White House.
- The Rundown AI reports the NSA urged anyone unable to patch immediately to take systems offline, and Cloudflare said it was seeing early attacks.
- A GitHub tool lets server operators check whether their PHP version is affected.
Why it matters for marketers: Many marketing sites, blogs and CMS installs run on PHP, so teams need to confirm patch status now and ask hosts and agencies what they have done.
Patches are out for two critical flaws in PHP, the language behind a large share of the web. According to The Decoder, OpenAI's GPT-5.6 Sol found the problem through its Patch-the-Planet initiative. Security firm Wiz reported finding the same flaws on its own, using its Wiz Atlas platform with Sol and Google's Gemini 4 Argon.
The Rundown AI reports that the bugs are a decade old and let attackers take over servers without a login. It also says the NSA urged anyone who could not patch right away to pull systems offline, and that governments in Finland, Germany and the Netherlands took websites down. Cloudflare said it was seeing early attacks emerging.
For marketers, the exposure is practical. Many company sites, blogs, landing pages and content management systems run on PHP, often managed by a host or agency. A compromised server can mean defacement, lost leads, tracking tampering and damaged brand trust. Wiz argues that language models make exploits easier to adapt across PHP versions and configurations, which lowers the cost of attacking many sites at once.
The immediate step is to ask your hosting provider, web developer or agency whether the patch has been applied, and to use the GitHub checker that The Decoder says is available for operators. OpenAI expects more findings of this scale in the coming months and says the same capabilities can help attackers. Teams should build patch review and vendor accountability into regular site operations.
Sources
This brief is our own summary. Read the full reporting at the source.
