--- title: "Frontier OpenAI Model Exposes Stunning Exploit That Leaves Millions of Web Servers Open to Attack" description: "An OpenAI helped identify critical security flaws in the PHP software that underpines nearly 70 percent of the entire internet." date: "2026-10-21" modified: "2026-10-21" authors: - name: "Frank Landymore" job_title: "Contributing Writer" link: "https://futurism.com/authors/flandymore.md" url: "https://futurism.com/future-society/openai-php-exploit-millions-web-servers" categories: - "Artificial Intelligence" - "Computing" - "Cybersecurity" - "Future Society" - "OpenAI" - "Robots and Machines" --- # Frontier OpenAI Model Exposes Stunning Exploit That Leaves Millions of Web Servers Open to Attack ![OpenAI CEO Sam Altman is shown gesturing with his hands.]() *Shutterstock / jamesonwu1972* Security researchers using an OpenAI model have uncovered two stunning security flaws in PHP, the software that underpins nearly 70 percent of all websites on the internet. The flaws are so catastrophic that all websites using PHP — all untold millions of them — are advised to immediately take their servers down and apply the latest patch, which was released Wednesday. Vast swathes of the internet, following the news, have gone dark. Some that went offline for a time include Wikipedia, Steam, and even government websites. Many organizations, however, may not have the time, resources, and personpower to swiftly implement the patch, making them potential sitting ducks until they do. According [to the *New York Times*](), the information released on the vulnerability can be used to reverse engineer the attack and take control of victim's servers and steal information. The best course of action if you can't patch your website, the National Security Agency advised, is dramatic: keep your site offline and don't turn it back on. Just as extraordinary as the breadth of the threat was how it was identified. The flaws were discovered by researchers at the cybersecurity firm Calif by using OpenAI's GPT-5.6 Sol model, as part of a collaboration with the AI company. It then reported the flaw to the PHP Foundation back on August 11. The Google-owned security firm Wiz independently found the flaws, too, and made a report on August 24. Wiz called it one of the "most severe vulnerabilities discovered in PHP, and arguably in software history." Adding to the alarm presented by the exploits, there have been concerns raised over OpenAI's role in how they were identified. The flaws have been present in versions of PHP dating backing to 2004. But through OpenAI's "Patch the Planet" program, and by using its flagship GPT-5.6 Sol model, Calif found it in only a matter of days. In a sense, these exploits only exist because of current powerful AI models. And moreover, OpenAI encouraged their discovery through its programs. The messy disclosure of the vulnerability doesn't help matters. OpenAI followed standard responsible practices, but some of the details around the hack [leaked a day before]() it was officially scheduled to be announced. Even if no leaks occurred, though, the damage caused by the mere knowledge that the vulnerabilities exist — which again, is largely thanks to AI — would still be catastrophic. It was the inevitable next chapter in all the bluster around AI companies revealing their agentic models' hacking prowess. A [headline in *The Atlantic*]() proclaimed that the "AI-Hacking Apocalypse Began Last Night." OpenAI will tout the discovery as undeniable proof of its AI's capabilities, while the rest of the world picks up the pieces of a shattered internet. **More on AI:** [*AI Experts Already Doomsday Prepping for When AI Takes Out the Entire Financial System*]() ## Author At Futurism, my work has often centered on bringing a sense of clarity and insight to complex topics ranging from the regulation of emerging technologies to the esoteric ideologies of Silicon Valley executives, while striving not to lose the poetic sense of awe inspired by often-obscure fields like astrophysics and quantum computing. I broke the story of CNET using AI to produce articles that turned out to be riddled with factual errors and plagiarism — a dam-breaking inflection point, as I've reported, that's inspired copycats and endless discourse while beguiling stakeholders ranging from tech giants to purveyors of spam around the web. My work at Futurism has been cited by publications including CBS News, the Los Angeles Times, Vice, Gizmodo, Engadget, the Verge, and Vanity Fair. I grew up in locales ranging from India to China, and now live in the exotic suburbs of Virginia. In my free time, I'm an avid reader of weird sci-fi literature, an aficionado of East Asian cinema, and, regrettably, a relapsed gamer. Allegedly, I’m working on a debut novel, currently untitled. ### Author social links [Bluesky]()