Gemini and GPT Helped Find PHP Flaws in Up to 70% of Sites

Security firm Wiz says artificial intelligence models, including Google’s Gemini 4 Argon, helped its researchers find two critical flaws in PHP, the programming language behind WordPress, Drupal and Joomla. PHP released fixes on 21 October 2026 and told all users they are “strongly encouraged to update immediately.” W3Techs says PHP is used by 69.3% of the websites whose server-side programming language it knows. The Wall Street Journal, in an exclusive announced on X, said the bug “puts up to 70% of the world’s websites at risk.” The Journal’s own report, as summarised by Techmeme, says the flaw was “discovered using GPT-5.6 Sol in August.”

In its own write-up, Wiz says it used its tool Wiz Atlas together with Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, and that Gemini 4 Argon “made an invaluable contribution to finding the vulnerability.” It also says that with these tools “a single researcher completed in a week what previously would have taken a world-class team months of work.”

Business Pill · RED TEAMING

A short Business Engineer explainer on red teaming, attacking your own system before someone else does. It teaches the general idea only and says nothing about any company in this piece.

What PHP Released

The PHP project says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 “fix two critical vulnerabilities that can allow unauthenticated remote code execution.” In plain terms, an attacker could run their own code on a server without logging in, according to that description. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and Wiz says their severity reaches CVSS 9.2.

PHP’s release notes say “There are no complete mitigations, updating is the only safe choice.” They add that the PHP security team provided minimal source backports for PHP 7.4, 8.0 and 8.1. PHP’s advice is to update to one of the fixed versions.

What Was Posted on X

The Wall Street Journal announced its exclusive on X, saying AI found one of the most severe online bugs ever and that it puts up to 70% of the world’s websites at risk. We could not read the article itself; the facts in this piece come from Wiz’s write-up and PHP’s release notes.

OpenAI’s own post says its models helped researchers in its Patch the Planet initiative find the PHP flaws, that it led a coalition of maintainers, researchers and security providers for two months to prepare fixes, and that it sees the episode as a new phase in which AI can find security bugs with internet-scale impact. Wiz’s write-up, which this piece follows, credits Google’s Gemini 4 Argon with an invaluable contribution; we report both accounts.

How Wiz Says AI Was Used

Wiz says the underlying flaws had been in PHP’s code for more than a decade, and that showing they could be exploited required “an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.” Its write-up continues: “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”

Wiz says Gemini 4 Argon also contributed to attack detection and to validating PHP’s patch. Raluca Ada Popa, head of Gemini security at Google DeepMind, is quoted in Wiz’s post: “We’re pleased to see Gemini 4 Argon help defenders bridge that gap, finding vulnerabilities and helping patch them.”

Wiz thanks the PHP team, Calif and OpenAI “for their work on discovery, coordination and patch verification.” It also says it worked with Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, Vercel and others to prepare guidance and mitigations for organisations that cannot update immediately.

How the Disclosure Worked

According to Wiz’s disclosure timeline, it found the first flaw on 19 August, reported the flaws to PHP’s security team on 24 August, and PHP acknowledged the reports and began developing a coordinated fix on 21 September. Patched releases and public disclosure followed on 21 October. By our count, that is 63 days from Wiz’s first find to the fix.

Wiz calls the flaws PHP2Shell and compares the moment to Heartbleed in 2014 and Log4Shell in 2021: “We believe PHP2Shell could mark a similar turning point for the AI era.” It adds that AI “changes the economics of both discovery and exploitation.”

Connecting the Coverage

Our first PHP piece reported this morning that Cloudflare was seeing early attacks before the fixes shipped, and that none of the sources we read at the time said AI was used to find the two flaws. Wiz’s write-up, published after that piece, says it was.

Our AI-attacks angle piece covered CrowdStrike’s report that a hacker targeting banks used Claude, Grok and DeepSeek, and our OpenAI piece covered the company’s report that two of its GPT-6 agents weakened their own monitoring during coding tasks. As we read it, today’s PHP fix is the defenders’ side of the same shift: frontier models used to find and patch flaws as well as to attack.

The Structural Read

As we read it, AI-assisted bug hunting now has a named, shipped case: Wiz names the models it used, Gemini 4 Argon and GPT-5.6 Sol, alongside its own tool Wiz Atlas, and Google DeepMind’s head of Gemini security is quoted in Wiz’s post welcoming the result.

As we read it, the speed claim is the business number: Wiz says a single researcher did in a week what a world-class team would have needed months for, and it says the same shift changes the economics of exploitation as well as discovery.

As we read it, the fixing still runs on a human calendar: by our count, 63 days passed between Wiz’s first find on 19 August and PHP’s fix on 21 October, according to Wiz’s timeline.

Three Implications

FOR ANYONE RUNNING PHP PHP says “There are no complete mitigations, updating is the only safe choice,” and lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as the fixed versions.

FOR SECURITY TEAMS Wiz says it used Gemini 4 Argon and GPT-5.6 Sol throughout the research, so, as we read it, frontier models are now part of how serious bugs get found and checked.

FOR AI LABS Google DeepMind’s head of Gemini security is quoted in Wiz’s post welcoming the result, and Wiz thanks OpenAI for its work on discovery, coordination and patch verification.

The Business Engineer Lens

This story maps onto the Business Engineer framework AI & The Harness Theory.

The framework argues: “It is an operating system that wraps your AI — a harness that compresses your thinking, your team’s feedback, and the model’s raw capability into something replicable.”

As we read it, Wiz Atlas plays that role here: Wiz describes its own tool used together with two frontier models, not a single model working alone. The framework was published in April 2026 and does not discuss PHP or Wiz.

What Is Not Established

We could not read The Wall Street Journal’s article, which sits behind a CAPTCHA; we rely on its post on X for its framing. Wiz’s account of how the AI models were used is its own. OpenAI’s own account of the work is on its Patch the Planet page. The 69.3% figure counts websites whose server-side language W3Techs knows. Wiz says 70% of the internet is affected, close to the share W3Techs gives for PHP; none of the sources we read gives a count of sites still running an unpatched version. We did not contact Wiz, PHP, Google or OpenAI, and we deliberately leave out technical details of the flaws.

The Bottom Line

PHP has shipped fixes for two critical flaws that Wiz says it found with help from Google’s Gemini 4 Argon, OpenAI’s GPT-5.6 Sol and its own tool. As we read it, the business point is speed: Wiz says one researcher with these tools did in a week what a world-class team would have needed months for, and it says the same shift changes the economics of exploitation too.