AI-assisted PHP discovery puts patch coordination in focus

In its October 21 account, OpenAI says Calif found a PHP flaw using GPT-5.6 Sol. PHP’s maintainers led the fixes and release. The proposed framework leaves advance notification decisions with maintainers: researchers help test fixes, providers prepare protections, and public guidance accompanies an available patch. Deployment support continues afterward; this is a proposal, not a universal requirement.

For website operators, the PHP advisory identifies the immediate action: install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. These releases fix two critical flaws allowing attackers to run code remotely without authentication. The warning covers all PHP installations serving web requests. Maintainers urge immediate updates and direct users to vendors for updated packages, since distributions received patches in advance. Temporary mitigations reduce exposure to particular attack paths; they do not make an installation safe. Updating remains the complete solution.

OpenAI’s version checker helps interpret exposed version information, with separate skills for server access and URL-only checks. It reads HTTP headers or the local PHP version, without following redirects or inspecting page bodies. Hidden headers produce UNKNOWN, which does not mean patched. An OK result only compares the reported stable version against an embedded cutoff, assuming later patches contain the fix. It does not verify the fix independently. Distribution backports may retain an older version number, so the documentation calls for checking official PHP release information.