OpenAI finds PHP vulnerability that took down DigiD and the House of Representatives

On October 21, 2026, important Dutch websites such as DigiD, MijnOverheid, and the site of the House of Representatives went offline due to a serious PHP vulnerability that was discovered using OpenAI's AI model GPT-5.6 Sol. The security company Calif searched the open-source software with this model and discovered one of two vulnerabilities on August 11, known together as PHP2Shell (CVE-2026-109618 and CVE-2026-109619).

The vulnerabilities allow attackers to remotely take over a web server and received a severity score of 9.2 out of 10. They affect any server running PHP 5.4 or newer, which means a significant number of websites worldwide are vulnerable. The creators of PHP quickly took action to fix the issues in collaboration with various security companies, including Cloudflare.

OpenAI seems to have played a predictive role in this; the vulnerabilities were discovered earlier than by potential attackers, allowing web administrators and security specialists time to repair their systems and prepare for possible attacks. This preventive aspect is emphasized in a message from OpenAI about their initiative 'Patch the Planet', where they use AI models to identify vulnerabilities in open-source software.

Nonetheless, OpenAI warns that the technology can also fall into the hands of malicious actors, who can use the same AI capabilities to generate attack code. According to OpenAI, PHP2Shell is just one example of numerous vulnerabilities discovered with AI, which has also prompted other AI companies to actively search for leaks in software.

The National Cyber Security Centre (NCSC) has analyzed the acute security risk and recommended taking vulnerable sites offline. The relevant websites were taken offline as a precaution while the PHP versions were updated to avoid further risks.

Read the full article from AI Insider.