A coordinated vulnerability disclosure has sent cybersecurity defense teams worldwide into emergency mitigation mode after security researchers leveraged artificial intelligence models to discover two critical zero-day flaws in PHP, the server-side language underlying approximately 70 percent of the public web.

The disclosure, led by security researchers alongside OpenAI, reveals that models including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon independently identified severe, decade-old vulnerabilities capable of granting unauthenticated attackers root-level access to affected web servers without requiring valid login credentials.

Decades-Old Flaws Unearthed by AI

The vulnerability discovery process began when boutique cybersecurity firm Calif identified the initial flaw using automated code-analysis pipelines driven by GPT-5.6 Sol. Weeks later, researchers at cloud security provider Wiz independently flagged the same flaw and an associated secondary vulnerability using an ensemble of frontier models.

OpenAI confirmed that it spent over two months coordinating privately with PHP core maintainers, cloud security providers, and intelligence agencies prior to releasing public advisories. The vulnerabilities, which resided deep inside legacy memory-management routines of PHP's core codebase, had gone undetected during routine manual audits for over a decade.

Security analysts emphasize that the vulnerabilities represent severe remote code execution (RCE) vectors. In unpatched environments, a remote adversary can forge specially crafted HTTP packets that exploit memory corruption, allowing arbitrary commands to run with the permissions of the underlying web daemon.

Coordinated Defense and Government Advisories

The severity of the findings prompted immediate intervention from international regulatory bodies and intelligence institutions. The United States National Security Agency (NSA) issued an emergency advisory urging systems operators who cannot immediately deploy vendor patches to pull vulnerable applications entirely offline.

Simultaneously, public administration portals across several European countries, including Germany, Finland, and the Netherlands, temporarily took administrative interfaces dark to safeguard critical backend databases. Cloud infrastructure provider Cloudflare reported observing early reconnaissance scanning and nascent exploitation attempts within hours of the coordinated release.

Key takeaways from the defensive rollout include:

* Pervasive Attack Surface: PHP remains the execution runtime for a vast majority of content management systems and legacy enterprise applications, exposing hundreds of millions of public domains. * Dual-Use Acceleration: While advanced AI models are increasingly weaponized by threat actors, this case demonstrates their profound utility in proactive, defensive static analysis. * Pipeline Expansion: OpenAI stated that this patch is among the first of several major software vulnerabilities uncovered by its safety and alignment teams currently undergoing remediation across the open-source software supply chain.

The Shift in Automated Code Security

The discovery marks an inflection point in automated security auditing. Historically, automated static application security testing (SAST) tools produced overwhelming volumes of false positives when auditing expansive C-based codebases like the PHP core engine.

Frontier reasoning models, however, are exhibiting an unprecedented capacity to trace complex execution graphs across disparate modules, synthesizing exploit chains that previously required hundreds of hours of elite human reverse engineering. As AI-assisted code auditing matures, maintaining legacy infrastructure will increasingly demand automated defensive auditing to preempt malicious automated exploitation.