OpenAI uses AI to find critical security flaws in PHP

What OpenAI says it found

As The420.in reported, researchers at OpenAI and partner organizations used advanced AI models to uncover critical security flaws in PHP. PHP is a programming language that runs the behind-the-scenes logic of websites, and the report says it powers nearly 70 percent of sites worldwide.

The work came out of Project Daybreak, a cybersecurity initiative at OpenAI. The team used the company's latest AI model, though the report does not name it. Because so many online services rest on PHP, the report describes the risk as widespread.

The report calls the flaws critical but does not say how many there are or give technical details. Those are the questions to watch as more information is published.

Two months of checking before going public

Clint Gibler of OpenAI's cybersecurity team led the effort. According to the report, specialists spent more than two months verifying the findings and evaluating possible fixes. The goal was to make sure the flaws were dealt with before they were disclosed publicly.

That step matters. An AI model can flag something that looks like a bug, but a person still has to confirm it is real, work out how dangerous it is, and test a repair. Announcing a flaw before a fix exists would hand attackers a map.

The report adds that millions of exploitation attempts were reported during this validation period. That figure suggests how quickly attackers move on weaknesses in widely used software. The source does not explain how those attempts were counted or whether they were tied to these particular flaws, so treat the number with care.

AI is helping both defenders and attackers

The PHP discovery is part of a wider pattern. The report says models from OpenAI, Anthropic and newer firms such as Depthfirst have found weaknesses in web browsers and internet software. Defensive teams can use these tools to spot flaws and draft patches much faster than manual work allows.

The same ability can be pointed the other way. Security professionals quoted in the report are particularly worried about powerful, easy-to-get tools, including Chinese open-weight systems like DeepSeek and Kimi. Open-weight means the trained model is released so anyone can download and run it. Experts say that could lower the barrier for attackers who want to find flaws and carry out breaches at scale.

Attackers are already using AI

The report says this is no longer only a theoretical risk. Threat actors have reportedly used models such as Anthropic's Claude and DeepSeek to illicitly capture hundreds of thousands of payment card records and to compromise roughly 100 websites.

It also cites a Microsoft disclosure that Chinese hackers used an AI agent tool called Artex, originally built for security testing, to target hundreds of entities. Those included government and military institutions. An AI agent is software that can take a series of actions on its own toward a goal, rather than just answer one question.

These claims come from the report's summary of other findings, and we have only this one outlet's account of them.

What happens next

The report frames the situation as a race. Developers and infrastructure providers need to deploy, verify and maintain security updates quickly so that AI ends up strengthening defenses instead of weakening them.

For ordinary site owners, the practical weak point is slow updating. Many small business sites, online shops and blogs run on PHP-based software, sometimes with nobody actively maintaining it. Those sites are the easiest targets when a flaw becomes known.

Still unclear from the coverage: how severe the flaws are, how many there are, and whether fixes have been released everywhere. Until those answers arrive, the safest assumption is that updates matter.