AI Models Discover Critical PHP Vulnerabilities Triggering Internet-Wide Crisis

Two critical PHP flaws, both rated 9.2 out of 10, were reportedly found by AI models scanning the codebase. The patch leaked six hours before anyone was ready. Amazon saw active exploitation four days before the official announcement. And nearly half of the highest-traffic PHP sites run versions too old to receive the fix at all.

Before rewriting every security runbook, start with the central model named in the story: "GPT-5.6 Sol" is not a product OpenAI has shipped. When the key actor in a security claim is unverifiable, treat the whole narrative carefully. The embargo breaking early is a coordination failure, the kind humans have been producing for decades. That Amazon saw exploitation before the announcement could reflect a leaked embargo and ordinary attackers, not AI-accelerated discovery. The more interesting question, whether independent systems converged on the same two flaws without coordination, remains unproven in this case.

That said, the structural concern is real regardless of this story's sourcing. Researchers have been pointing large language models at codebases for two years. When capable code-scanning models become cheap and common enough that multiple unconnected parties land on the same flaw simultaneously, the embargo model stops protecting anyone. Coordinated disclosure was designed around human timelines: weeks between discovery and exploit. Compress that to hours and the whole arrangement breaks. CISA and the sector response teams were not built for a world where the discovery tool is a commodity available to attackers and defenders alike.

The Internet Archive case is the most concrete new data point here. It used Claude to simulate attacks and generate patches while under live exploitation, the first well-documented instance of AI as an emergency responder rather than just a scanner. But that response required on-premise inference capacity. The 46% running end-of-life PHP are on shared hosting with no GPU budget and no patch path. The organizations most exposed are precisely the ones who cannot run the defense. Governance frameworks and disclosure norms will not change that arithmetic.

For anyone running PHP services, the procurement question has shifted. It used to be which scanner catches the most. Now it is whether your patch pipeline can deploy a fix in hours, and whether you have a web-application firewall layer that works on day zero before the patch is even available. Managed defensive-scanning services from cloud providers will be the easy answer a CISO can take to the board. Whether they are worth the line item depends on a fact nobody has demonstrated cleanly yet: proof that AI actually compressed the attacker's clock in this case, and not just the coordination process around it.

The call: OpenAI, Anthropic, or Google DeepMind will publicly report at least one additional AI-discovered vulnerability rated CVSS 9.0 or higher in widely-used open-source software, exploited in the wild before a patch was broadly available, before 2027-04-28. Medium confidence. OpenAI has already said more cases are coming and benefits from being seen as the responsible party surfacing them. Old, widely-deployed open-source code is exactly where undiscovered critical flaws accumulate, and a lab actively promoting this capability has every reason to keep publishing. What a second published case would prove: that the labs keep finding and disclosing these. What it would not prove: that the attacker's clock moved faster than a human researcher's would have. That is the harder measurement, and nobody has shown it yet.

Two critical PHP flaws, both rated 9.2 on a 10-point severity scale, found by AI models running against the code. The patch leaked six hours before anyone was ready. Amazon saw attackers using the flaw four days before the official announcement. Nearly half the biggest PHP sites run versions too old to even receive the fix. The question for anyone building with or buying AI: did the machines actually change the attacker's clock, or did a human process failure get a shiny AI label stapled to it?

The Skeptic. Start with the model name. "GPT-5.6 Sol" is not a model OpenAI has shipped. When the central actor in a security story is a product nobody can point to, slow down. Researchers have been pointing LLMs at codebases for two years. Finding a 9.2 in PHP is not new. People have done it by hand for decades. The embargo broke early because a human leaked it, which is a coordination problem older than the internet. OpenAI's claim that findings will keep climbing is a company that sells the scanner telling you that you'll need more scanning. That's a sales forecast with a safety costume on. Prove the attacker timeline actually moved before you rewrite every runbook.

The Safety Lens. The part that holds up regardless of the model name: the same capability that finds the hole hands it to whoever runs the model next. Coordinated disclosure was built around human speed. A researcher finds a bug, a vendor gets weeks, a patch ships, then you talk. Compress that to hours and the whole arrangement stops protecting anyone. The embargo breaking early isn't the story. The story is that even a clean embargo buys you less now, because once a capable model exists, anyone pointing it at PHP finds the same door. CISA and the sector response teams were not built for a world where the discovery tool is a commodity. No framework governs this today, and "we expect more" from the vendor is not a framework.

The Researcher. The genuinely new signal is convergence. Multiple unconnected sources landing on the identical two flaws, with no coordination, is a different thing from one clever team getting lucky. When independent systems reach the same answer, the easy discoveries are getting cheap enough that everyone finds them at once. That's the curve going vertical, and it cuts both ways. The Internet Archive using Claude to generate fixes while under live attack is the first well-documented case of AI as an emergency responder, not just a scanner. That's the hopeful half nobody's quoting. The dangerous half: the attacker and the defender are drawing from the same well, and the attacker doesn't have to coordinate disclosure with anyone.

The Compute Pragmatist. Here's what the convergence story skips. The Internet Archive fixed itself because it could run models locally to simulate attacks and generate patches under fire. That takes real on-premise inference muscle. The 46% running end-of-life PHP are on shared hosting with no GPU budget and no patch path. So the ability to defend at the speed of attack is becoming a function of who can afford to run models at the moment of exploit. The organizations most exposed are precisely the ones who can't run the defense. As OpenAI promises more findings, continuous code scanning turns into a security line item, and the hyperscalers will sell it as a managed service long before any startup gets a look.

The Enterprise Buyer. If you run PHP services, your procurement question just changed. It used to be "which scanner catches the most." Now it's "can my patch pipeline deploy a fix in hours, and do I have a virtual patch or web-firewall layer that works on day zero." Nearly half the exposed surface here had no patch path at all. If your vendor contracts assume weeks between disclosure and exploit, those assumptions are stale. The managed defensive-scanning services the cloud providers are about to push will be an easy signature for a CISO under board pressure. Whether they're worth it depends on something nobody can show you yet: proof the AI actually compressed the attacker's clock.

Where they split. The Skeptic and the Researcher are arguing about one fact: did AI materially change the attacker timeline, or is this a human embargo failure that got an AI headline stapled to it? The whole story rests on it. If Amazon's early exploitation came from a leaked embargo and ordinary attackers, nothing fundamental shifted. If independent attackers found the flaw with a model before the leak, the disclosure model is genuinely broken. Second split: the Safety Lens wants CISA in the room now, the Compute Pragmatist says governance is beside the point when the exposed half can't run the defense anyway. You can write all the disclosure norms you want. Shared-hosting PHP on end-of-life versions won't read them.

What this hinges on. One belief: that capable code-finding models are now cheap and common enough that multiple parties find the same flaw at the same time. If that's true, the embargo model's protection shrinks no matter who leaks. Everything else, the compute asymmetry, the governance gap, follows from it. What to verify before acting on it: don't trust the "GPT-5.6 Sol" sourcing, but do watch whether the next three months bring a second incident where AI-found flaws are exploited before a patch exists. That's the thing that would turn a dramatic one-off into a pattern. The council leans toward the Researcher on the capability direction and the Skeptic on this specific story's sourcing. Both can be right: the capability is real, the particular tale is thin.

Prediction: OpenAI, Anthropic, or Google DeepMind will publicly report at least one additional case of an AI-discovered critical vulnerability (CVSS 9.0 or higher) in widely-used open-source software being exploited in the wild before a patch was broadly available, by their next major safety or threat-intelligence disclosure before 2027-04-28.

Confidence: Medium — OpenAI has already said more cases are coming and benefits from publishing them.

Why: OpenAI stated on the record that the PHP and GitLab bugs are "among several significant vulnerabilities we've already found" and that the pace of such findings will climb in the coming months. A lab that has said this publicly, and that benefits from being seen as the responsible party surfacing these flaws, will keep publishing them, because the narrative sells both the capability and the safety posture. The mechanism isn't marketing alone: if independent systems really are converging on the same flaws, the base rate of AI-found critical bugs in old, widely-deployed code is climbing, and old open-source code is exactly where the undiscovered 9.0-plus flaws sit. The opposite outcome, total silence for six months, would require the labs to stop talking about a capability they are actively promoting, which runs against their stated incentive.

Revisit by 2027-04-28: We're right if a frontier lab publishes a specific second case of an AI-discovered CVSS 9.0+ flaw in common open-source software exploited before a wide patch. We're wrong if no such named case appears in any major lab's disclosures by that date.

One caveat the reader should hold: a published case proves the labs keep finding and disclosing these. It does not by itself prove the attacker's clock moved faster than a human researcher's would have. That's the harder thing to measure, and nobody has shown it cleanly yet.