GPT-5.6 Sol Uncovers Critical PHP Flaw Threatening 70% of Web
AI security firm Calif leveraged the GPT-5.6 Sol model to discover two critical CVSS 9.2 vulnerabilities in PHP's core memory management, enabling unauthenticated server takeover. As PHP underpins ~70% of global websites, this finding forced an emergency patch release and demonstrated the disruptive efficiency of LLMs in automated code auditing and zero-day discovery.
Full Report
Rohan Paul (@rohanpaul_ai) · 2026-10-21 17
Researchers using GPT-5.6 Sol found massively critical flaw in PHP, which runs about 70% of websites, knocked major sites offline as operators rushed to patch.
Calif, an AI security firm, who found this, said in a statement that the vulnerabilities could put 70% of the world’s websites at risk if they aren’t patched quickly, and called them “the most severe vulnerabilities ever discovered by AI, if not in all of software history.”
PHP rushed out fixes as it could let attackers without accounts take over web servers.
Both bugs score 9.2 on the CVSS severity scale and affect PHP versions as old as 5.4.
When a request hits PHP’s memory cap at the wrong moment, PHP frees memory but keeps pointers to it, which a later request on that worker can hijack.
Auditors spotted the weakness in 2024, but the fix stalled for months, partly because nobody had shown a practical attack.
Wiz, a cloud security company, now owned by Google, says the models let one researcher finish in a week what once took a top team months.
A leak of the CVE numbers forced PHP to ship a day early, and Cloudflare now reports early attack attempts.
