OpenAI atribuye a GPT-5.6 Sol el descubrimiento de una vulnerabilidad crítica en PHP, el lenguaje que sostiene una parte importante de la web. El hallazgo se produjo dentro de la iniciativa Patch the Planet, aprobada para identificar y corregir errores de seguridad. El resultado adquiere unRelevance especial porque la firma de ciberseguridad Wiz llegó de forma independiente a la misma conclusión utilizando el modelo Gemini 4 Argon de Google.
El并行 hallazgo de dos sistemas de IA de distintos proveedores、同—— over the same flaw—— suggests that artificial intelligence is beginning to accelerate the discovery of vulnerabilities at a scale previously difficult to cover. Traditional security audits depend on manual code reviews, fuzzing, static analysis and the experience of researchers. AI models can process large volumes of code, explore attack paths and compare suspicious patterns much more quickly.
PHP remains one of the most widely deployed technologies for websites, including content management systems, stores, portals and public-sector platforms. Consequently, even a vulnerability affecting a limited range of versions or configurations could have a considerable impact if it is present on popular services. The potential reach of millions of sites does not mean that all have been compromised; rather, it reflects the enormous installed base of PHP and the possibility that a single exploitable defect could be replicated across many online services.
La información difundida no precisa el tipo de vulnerabilidad, las versiones afectadas ni los indicadores de compromiso. For defenders, these data will be essential to determine exposure, apply patches and verify whether an intrusion has occurred. Wiz and OpenAI will also have to provide enough technical detail for administrators to reproduce the problem without facilitating malicious exploitation. A responsible disclosure process must offer organizations a reasonable window to update their systems before attackers can use the same capabilities independently.
The episode also highlights a dual-use problem inherent in these tools. The same models that help researchers find flaws can help malicious actors locate, adapt and exploit them. OpenAI itself warns about this asymmetry: reducing the cost of vulnerability discovery for defenders may also reduce it for attackers. The security value of AI therefore depends not only on its precision, but also on controls, access policies, monitoring and coordination between the companies developing these systems and the research community.
For the cybersecurity industry, the important advance is not that an AI found a bug in isolation, but that two different systems were able to reach the same result. This could make the identification of critical flaws more scalable and shorten reaction times. It will not replace expert researchers; it will reshape their work, automating portions of the search and allowing them to focus on validation, impact analysis and remediation.
The case is a warning for organizations that still treat patching as a routine task. A critical flaw in a widely used layer such as PHP can affect websites that appear unrelated and spread through outdated dependencies, shared hosting or neglected internal systems. In this context, inventorying versions, prioritizing updates and monitoring abnormal activity are no longer optional. The double discovery by GPT-5.6 Sol and Gemini 4 Argon shows that the frontier between AI-assisted defense and AI-assisted offense is narrowing, leaving less time to react when the same vulnerability becomes public.
