AI
“In 2026, security firm Calif used OpenAI's GPT-5.6 Sol to uncover the severity of a PHP vulnerability that developers had first spotted signs of in 2024.”
Plain restatementIn 2026, the security firm Calif used OpenAI's GPT-5.6 Sol model in work that established the seriousness of a PHP vulnerability whose early indications had been noticed by PHP developers in 2024.
This one largely checks out, which is unusual for a viral post of this kind. GPT-5.6 Sol is a real OpenAI model, Calif is a real security firm, and OpenAI's own published account says Calif used that model to identify a critical PHP flaw under a programme OpenAI funded. The PHP Foundation has confirmed that one of its own developers noticed early signs of the same underlying problem during a 2024 security audit but could not find a way to exploit it or agree on a fix, and it has called that delay a structural failure. Emergency patches were released on 21 October 2026 for two flaws rated 9.2 out of 10. Two small caveats: Calif's own write-up describes a human researcher spotting the pattern first and then using the AI to search for related cases, so this was AI-assisted rather than AI alone, and the specific credit to that model comes from OpenAI and Calif, who were working together. Separately, two figures in the post's images are shakier than the caption: PHP runs closer to 70 to 75 percent of sites whose language can be identified, not 80 percent of the internet, and the claim that attackers would reverse engineer the patch within 15 minutes has no source I could find.
In 2026, security firm Calif used OpenAI's GPT-5.6 Sol [drifted from the evidence:] to uncover the [drifted from the evidence:] severity of a PHP vulnerability [drifted from the evidence:] that developers had [drifted from the evidence:] first spotted signs of in 2024.
In 2026, [added by the neutral restatement:] the security firm Calif used OpenAI's GPT-5.6 Sol [added by the neutral restatement:] model in work that established the [added by the neutral restatement:] seriousness of a PHP vulnerability [added by the neutral restatement:] whose early indications had [added by the neutral restatement:] been noticed by PHP developers in 2024.
Red-tinted words in the claim drifted from the evidence. Green-tinted words are what a neutral restatement needs.
The trace / claim to source
- Calif is a real security firm and a real discoverer of record. The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026, and the cloud security company Wiz.
- GPT-5.6 Sol is a real, publicly released OpenAI flagship model, not an invented name.
- The model attribution is stated by OpenAI itself in its own published account, and is repeated in the same terms by multiple independent named outlets.
- PHP developers did spot early signs in 2024. The PHP Foundation's own account places the first signs of the out-of-memory problem behind CVE-2026-109618 in its 2024 external audit, with no concrete route to code execution found at the time.
- The year "2026" is correct for the Calif work: the audit began 30 July 2026 and the first finding is dated 1 August 2026 in Calif's own timeline.
- "Uncover the severity" is a fair characterisation rather than an overstatement. The 2024 developers had a suspected weakness without a demonstrated exploit; the 2026 work produced a demonstrated route to remote code execution, which is what changed the assessed severity.
- The caption's further statements also hold up: OpenAI reported the same underlying issue, Wiz separately reported vulnerabilities, and the Foundation did characterise the delay as its own failure. Per CNBC, the foundation acknowledged in a blog post that the delay was a "structural failure, caused by both the security team's decision process and its lack of resources."
- The claim reads as though one model did the uncovering. Calif's own published account puts a human researcher's inspection of memory-limit failures first and describes the AI as guiding searches for related failure paths from a pattern the researcher had already observed. The claim's wording "used GPT-5.6 Sol to uncover" is compatible with this, but a reader could take it to mean autonomous discovery, which no source asserts.
- Scale conflation, minor: "a PHP vulnerability" is singular and correct, but the 2024 signs relate specifically to the out-of-memory issue behind CVE-2026-109618, one of the two flaws patched. The 2024 link does not extend to the pair.
- Marketing as evidence, partial: the specific attribution to GPT-5.6 Sol originates with OpenAI and Calif, parties in a funded relationship with each other. This does not make the attribution wrong, and the vulnerability is independently confirmed, but no uninvolved party verified which model produced which finding.
- Exaggeration, in the post's image text rather than the caption: the images say PHP runs "80% of the internet." The measured figure is lower and is scoped to sites whose server-side language can be identified. Per Calcalist, PHP powers approximately 75% of websites whose programming language can be identified, according to web technology tracker W3Techs, and most coverage of this incident uses roughly 70%.
- Capability extrapolation, in the post's image text: the claim that attackers would reverse engineer the patch "within 15 minutes" is presented as an expectation with no stated source. I found no evidence for that specific figure. What was reported instead is slower and less certain: per CNBC, the PHP Foundation's executive director said there was no "evidence of any working exploits, only incomplete, misguided, and non-working generated ones," while a researcher said his team was able to code a working exploit in less than a day.
- OpenAI's two accounts of its own team's timing do not line up. Brockman's post says Calif used GPT-5.6 Sol to find a version of the bug in August and OpenAI's team found a more complete version independently in September, while reporting of the PHP Foundation's timeline places an OpenAI report of the same root cause on 11 August, the same day as Calif's. Which date applies to OpenAI's own finding is unresolved.
- The precise extent of the model's contribution inside Calif's work is not independently auditable. No third party observed the sessions, and there is no published transcript or reproducible harness, so "the model found it" versus "the model accelerated a human line of inquiry" cannot be separated from outside.
- Whether the thing noticed in 2024 and the thing exploited in 2026 are the same defect or a related one is stated by the PHP Foundation but not independently established. Brockman's framing of a "limited version" discovered in 2024 that "wasn't considered significant at the time" is a characterisation by an interested party.
Every named element of the claim exists and checks out. GPT-5.6 Sol is a real OpenAI model. OpenAI's GPT-5.6 line spans three tiers: Sol, its flagship; Terra, a lower-cost model; and Luna, its fastest and most affordable, with the number identifying the generation and the names identifying the tiers. OpenAI's own account states the discovery attribution directly: over the past two months OpenAI led a coalition of maintainers, researchers and security providers to address critical vulnerabilities in PHP, and Calif identified a critical flaw using GPT-5.6 Sol as part of OpenAI's Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities. On the 2024 element, the PHP Foundation's own post-incident account is the source. As reported by The Hacker News, the PHP Foundation said a core developer first found signs of the out-of-memory flaw behind CVE-2026-109618 during PHP's 2024 external audit, but a working attack was only theorized and no concrete route to code execution was found then, and competing fixes each risked breaking compatibility or opening other problems. The New Stack describes the same sequence: working in the Patch the Planet program, Calif used GPT-5.6 Sol to find a route to remote code execution and reported it to PHP on August 11, OpenAI independently reported the same underlying issue that day, and Wiz reported its findings on August 24; PHP's maintainers had spotted signs of the underlying out-of-memory problem in 2024, but its full impact became clear only in August. The 2024 audit is identifiable. In 2024 PHP had its first external security audit in years, funded by the Sovereign Tech Agency and carried out by Quarkslab, and while fixing one reported issue a Foundation-contracted core developer found the first signs of the out-of-memory problem. The human-and-AI division of labour is described in Calif's own published account: Calif dates the start of its audit to 30 July 2026 and its first discovery to 1 August, researcher Ryan Austin examined memory-limit failures and the points where they could interrupt PHP's native operations, and Calif then used the observed pattern to guide AI-assisted searches for related failure paths. Independent corroboration of the bug and of AI-assisted methods comes from the second discoverer. Wiz Research thanked the PHP team, Calif and OpenAI for their work on discovery, coordination and patch verification, and per TNW, Google's Wiz team said it found the flaws independently weeks later using Wiz Atlas, Google's Gemini 4 Argon and GPT-5.6 Sol, and PHP's advisory credits researchers from Calif, Wiz and OpenAI together. The underlying patch event is not in dispute. The PHP security team released emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, tracked collectively as PHP2Shell. Both are rated 9.2 on the CVSS v4.0 severity scale, which tops out at 10.
Complete reasoning
The reply is formatted for pasting into the thread where the claim is circulating.
Ask this case
Answers come only from the case file above; nothing is added.
Did GPT-5.6 Sol discover the PHP vulnerability by itself?
No. Calif's own account says researcher Ryan Austin first spotted the pattern of memory-limit failures, and the AI model was then used to search for related failure paths. It was AI-assisted work, not autonomous discovery.
Is it true that PHP developers already knew about this in 2024?
Partly. The PHP Foundation says a core developer found early signs of the out-of-memory problem behind one of the two 2026 vulnerabilities during a 2024 security audit, but no working exploit was found at the time and no fix was agreed on.
Who confirmed that GPT-5.6 Sol was used in this discovery?
The attribution comes from OpenAI and Calif, who were working together on OpenAI's Patch the Planet program. The underlying vulnerability itself was independently confirmed by Wiz, a separate security company, though no uninvolved party verified exactly which model produced which finding.
Does PHP really run 80 percent of the internet, as some posts claim?
No, that figure is not supported. Measurements cited in the case file put PHP's share closer to 70 to 75 percent of websites whose server-side language can be identified, not 80 percent of the internet.
Is it true attackers could reverse engineer the patch within 15 minutes?
The investigation found no source for that specific claim. It appeared in the post's images without evidence.