20-year-old PHP flaws hit 70% of the web; GPT-5.6 Sol helped find them
The Verge AI · rss · 2026-10-22
Two critical vulnerabilities in PHP — dubbed by security firm Wiz as "among the most severe vulnerabilities discovered in software history" — are wreaking havoc across the internet:
- An estimated 70% of websites use PHP in some capacity, including Wikipedia, WordPress, Drupal, DeviantArt and 4Chan; several sites were temporarily shut down, and even governments were affected
- The flaw exists in every PHP version going back roughly 20 years, many no longer supported — unmaintained legacy sites have little option but to shut down permanently
- The Internet Archive was briefly forced offline; two classic Japanese mobile games are shutting down over the exploit; the "PHP2Shell" technique hit Cloudflare hard
- Notably, GPT-5.6 Sol was used to identify the critical flaw, underscoring AI's growing role in vulnerability discovery
More from Safety
- Sanders calls to pause autonomous AI agents in bank accounts; critics push back — AIandDesign · 2026-10-23
- TechPolicy essay: system prompts are weak evidence of AI safety, outputs must be evaluated — mmitchell_ai · 2026-10-23
- Anthropic's deputy security chief warns cyber threats will get 'a lot worse before they get better' — Polymarket · 2026-10-23
- AI cyberattacks could paradoxically accelerate AI development in an offense-defense arms race — kimmonismus · 2026-10-23
- AI Now's People's AI Assembly spotlights data center opposition and labor rights — AINowInstitute · 2026-10-23
- Cloudflare CEO: Next two years of AI cyberattacks will be terrifying but make the internet more secure — johncoogan · 2026-10-23