> We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.
Grinding through abandoned source code in hopes of finding a vulnerability isn't exactly the most fulfilling work for many, perfect use case for AI which doesn't sleep.
The flaw was in at least 20 year old code, which seems to be a common theme for AI discoveries.
No compute costs for finding the issue or for writing the exploit are disclosed.
But it is marketed as if it were the first RCE found in human history.
> We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.
First the product they sell, then the product they got early access too...
I know they waited two months with this but wouldn't it be wiser to wait just a little bit more than a few minutes after the fix released?
Wiz is a google company...
a little self promotion there :P
Silly question, is PHP part of Project Glasswing? Crazy this has been dormant for a decade. And scary to wonder what else is lurking out there.
The OpenAI post linked says Sol assisted https://openai.com/index/coordinated-disclosure-of-critical-... and they invite more open source projects to apply to their program https://patchtheplanet.org/
Lots of stuff is PHP e.g. most message boards. It was very popular pre-dynamic web.
I just got a nostalgia hit remembering all the phpBB type boards.
But also I haven’t seen much of that style of bulletin boards in ages. Maybe the occasional EEVBlog or Ars kinda count?
Ye, no humans but "AI".
Grinding through abandoned source code in hopes of finding a vulnerability isn't exactly the most fulfilling work for many, perfect use case for AI which doesn't sleep.
Timeline from that article:
August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.
August 20, 2026: Unauthenticated RCE is confirmed against Drupal.
August 21, 2026: Unauthenticated RCE is confirmed against WordPress.
August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team.
September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix.
October 21, 2026: Patched PHP releases become available.
October 21, 2026: Public disclosure.
I want to understand how it leaked. I guess a whole lot of people were looped in between September 21 and October 21?
Simon, it seems you spend too much time close to the AIs and your writing is getting flagged.