OpenAI says ChatGPT Sol helped uncover critical PHP flaws that could affect 70% of websites
- ID
- 38255
- Status
- summarized
- Published
- 22 Oct 2026, 6:30 PM
- Fetched
- 22 Oct 2026, 8:00 PM
- Provider
- Tom's Hardware
- Category
- technology
- Original URL
- https://www.tomshardware.com/tech-industry/cyber-security/openai-says-gpt-5-6-sol-helped-uncover-critical-php-flaws-that-could-affect-70-percent-of-websites-ai-assisted-researchers-turned-two-year-old-bug-that-stumped-human-developers-into-working-exploits-in-two-weeks
- Source URL
- https://www.tomshardware.com/feeds/all
Summary
- Score
- 5.5
- Created
- 22 Oct 2026, 8:01 PM
- Tags
- Audience
- developersai_ml_learnersai_agent_usersstartup_founders
What happened
Tom's Hardware reports an OpenAI claim that its ChatGPT 'Sol' model (referred to in the URL as GPT-5.6) helped researchers turn a two-year-old PHP bug that had stumped human developers into working exploits in about two weeks, with the headline framing the flaws as potentially affecting 70% of websites. The article body available here is almost entirely site navigation and subscription boilerplate — no CVE identifiers, PHP versions, affected frameworks, vendor responses, or patch guidance are included. Treat the 70% figure and the two-week exploit timeline as OpenAI's own characterization relayed by a headline, not as verified technical detail.
Why it matters
There is not enough here to act on: no CVE, no PHP version, no list of affected libraries, so you cannot yet check whether your stack is exposed. The one decision-relevant number is the claimed two-week turnaround from old bug to working exploit — if your PHP-based app (WordPress, Laravel, legacy internal tools) has a patch cadence measured in months, that gap is the thing to shrink, but wait for the actual advisory before touching anything.
Discussion angle
The claim is a vendor saying its own model found the bugs — what would you need to see (CVE IDs, a reproducible writeup, patch diffs, independent confirmation) before you'd change your patch SLA based on AI-discovered vulnerabilities?