OpenAI says its models helped find critical PHP flaws, one of the most impactful vulnerabilities in recent memory, after a two month coordinated fix
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors. Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
Context
PHP runs a large share of the web, and OpenAI says this is the first time AI has found a security bug with internet scale impact ahead of attackers.
Patch the Planet is OpenAI's initiative that gives security researchers and maintainers model access and support to find and fix flaws in widely used software. According to OpenAI, the research firm Calif found a critical flaw using GPT 5.6 Sol, and the cloud security firm Wiz independently found and reported both vulnerabilities.
Deep dive
On October 21, OpenAI posted that its models helped researchers in its Patch the Planet initiative discover critical security flaws in PHP, a programming language it said runs an estimated 70% of websites. It said it led a coalition of maintainers, researchers and security providers for two months to prepare fixes before disclosure, because the fix required a major change to the PHP engine, and that every site using PHP can now safely upgrade.
OpenAI called it one of the most impactful vulnerabilities in recent memory and said it marks a new phase, where AI can find security bugs with internet scale impact. It said that, to its knowledge, frontier AI found the flaw before attackers, which it calls the Defender's Window.
OpenAI's blog says PHP's maintainers led the fixes and release, with Wiz, Cloudflare and others helping, and that it engaged US agencies including the Cybersecurity and Infrastructure Security Agency. It released a PHP version checker as a Codex skill, committed $1 billion in subsidized access to its Daybreak security tools for defenders with limited resources, and proposed a five stage framework for handling such findings. It warned that the same capabilities can help attackers build exploits, and that it expects similar findings to rise sharply.
Greg Brockman called the bug php2shell. Peter Steinberger, quoting OpenAI, said it was found with GPT 5.6 Sol and would cause havoc this week. The post itself gives no technical details of the flaws.
What to expect next
Watch how quickly websites and hosting providers apply the PHP updates, and for reports of attackers exploiting unpatched servers now that the flaws are public. OpenAI says more significant vulnerabilities are being fixed, so watch for further Patch the Planet disclosures. Also watch for responses from the security community to its proposed disclosure framework, and for other labs to report AI found bugs.