OpenAI AI Tool Uncovers Two Critical PHP Vulnerabilities Affecting 69 Percent of Websites

OpenAI's Codex Security tool helped uncover two critical vulnerabilities in PHP, the open-source scripting language that powers an estimated 69 percent of websites, before attackers could exploit them. The PHP Foundation announced the upcoming security release on October 20, 2026, with an emergency patch made available on October 21. OpenAI described the flaws as "one of the most impactful vulnerabilities in recent memory," citing PHP's widespread use across web infrastructure as the basis for that severity assessment.

The vulnerabilities carry the risk of remote code execution, according to advisories from CERT-EU and other security bodies. Reports indicate that some websites, including government sites in Europe and major forum platforms such as 4chan and Something Awful, went offline preemptively while awaiting the patch. Wordfence, a leading WordPress security plugin, warned that automatic updates would not apply the fix, urging site administrators to act manually.

In response to the severity of the disclosure, OpenAI announced a global cybersecurity initiative called Patch the Planet, framing the PHP episode as a demonstration of proactive, AI-driven vulnerability detection at scale. The company said it led a coalition in discovering and mitigating the flaws, positioning Codex Security as a tool capable of identifying critical issues in large codebases before malicious actors do. Reports also noted that hackers had already begun probing sites for exploit opportunities ahead of the official patch release.