Here’s a headline that’s easy to skim past if you’re not a developer: OpenAI says it helped coordinate the disclosure of two critical vulnerabilities in PHP, the programming language that quietly runs an estimated 70% of websites on the internet - including, almost certainly, whatever platform your business site is built on.
The part worth slowing down for isn’t the PHP flaw itself. It’s how it was found.
What actually happened
According to OpenAI’s own writeup, its model (branded GPT-5.6 Sol) was used as part of a program called “Patch the Planet” to hunt for serious bugs in widely-used open source software. It found - or helped find - two flaws in PHP’s memory handling that, left unpatched, would have allowed unauthenticated remote code execution. In plain English: a stranger with no login, no password, and no insider access could have taken over the server running your website.
Both bugs scored 9.2 out of 10 on the industry severity scale. That’s about as bad as it gets.
A security firm called Wiz independently found the same flaws, which is actually the reassuring part of this story - it means the discovery wasn’t a fluke of one tool. From there, OpenAI, PHP’s maintainers, Cloudflare, CISA, and several other agencies ran a two-month coordinated response: build the fix quietly, line up firewall protections, then release everything at once so attackers don’t get a head start.
It didn’t go perfectly. Details of the flaw leaked before the planned announcement, and PHP’s maintainers had to ship the fix a day earlier than scheduled. Cloudflare reported attempted exploitation in the wild around the same window. Even with AI in the loop and a two-month head start, the defensive margin was thinner than the press release makes it sound.
Why this matters even if you’ve never touched PHP
If your business website runs on WordPress, Magento, Drupal, or honestly most “I didn’t build this myself, an agency or a plugin did” setups - you’re running PHP under the hood, whether you’ve ever seen the word before today. You don’t need to know what memory handling means. You need to know whether your site has been patched.
This is the gap we keep running into with small business owners and AI coverage generally: the story gets told as “look what AI can do,” when the useful question is “what do I, specifically, need to do about it.” So here’s that version:
- If an agency or host manages your site, ask them directly: “Has our PHP version been updated since the October 2026 security release?” A real answer is a version number, not reassurance.
- If you manage your own WordPress or similar install, check your hosting dashboard for the PHP version and update to 8.2.13, 8.3.1, or later - whatever your host currently recommends as patched.
- If you genuinely don’t know who manages your site’s infrastructure, that’s the actual finding here, not the CVE score. Find out before you need to.
None of this requires you to become technical. It requires you to ask one specific, informed question instead of a vague one - which, incidentally, is the same skill that makes AI tools useful for anything else in your business.
The part worth being skeptical about
AI finding real, severe vulnerabilities in production software used by most of the internet is genuinely notable - this isn’t hype. But notice what’s doing the work in that sentence: a frontier AI lab with a dedicated security program, paired with a professional firm, running a two-month coordinated disclosure with government agencies. That’s a different thing entirely from “AI will secure your website for you.”
What AI is actually good at, for a business your size, is narrower and more immediately useful: catching the obvious stuff faster than you would by hand, flagging what needs a human’s attention, and asking better questions of the vendors who manage your technical risk. That’s not a smaller story than “AI finds internet-breaking bug” - it’s just a more honest-sized one for where you sit.
If you want to know which parts of your operations AI can actually touch safely - and which ones still need a real person checking the work - the AI Tools for Small Business guide walks through exactly that, tool by tool. Or if you’d rather just ask someone directly whether your setup is exposed, get in touch.