OpenAI says its AI helped find critical PHP web flaws

OpenAI says its GPT-5.6 Sol model helped find one of two critical vulnerabilities in PHP, the open-source programming language behind much of the web. The company has also proposed a five-stage framework for handling the larger number of AI-discovered bugs it expects to follow. In a blog post on October 21, OpenAI said it had spent two months leading a coalition of maintainers, researchers and security firms on the flaws. Security firm Calif found one of them using GPT-5.6 Sol through OpenAI's Patch the Planet initiative, and Wiz independently found and reported both.openai.com

The flaws, together called "PHP2Shell," could let hackers run malicious code on affected servers remotely, CNBC Comcast Corporation ↗ 3.44% reported. If exploited, attackers could take control of servers without a password, Axios reported. Wiz researchers wrote that the bugs rank "among the most severe vulnerabilities discovered in PHP, and arguably in software history."cnbc.com+1

Governments warn, tech firms respond

The U.S. National Security Agency told organizations on Wednesday to apply the updates and to take affected systems offline if they could not patch right away, CNBC reported. The FBI and authorities in Singapore, the U.K., Australia, Canada and the European Union issued similar alerts. Amazon Amazon.com, Inc. ↘ 4.57% said its MadPot system picked up attempts to exploit the flaws before they were made public, though it is still unclear how the attackers learned about them. Google Alphabet Inc. ↘ 3.08% said its Wiz unit used AI to investigate the bugs, and that Gemini helped test attacks and verify patches. Cloudflare ↘ 1.18% said it had added protections to its firewall.cnbc.com

OpenAI President Greg Brockman said the coalition had planned to disclose the flaws on October 22. Details leaked early, so PHP's maintainers released the fixes a day sooner, Mashable Ziff Davis, Inc. ↗ 1.61% reported. Wikimedia confirmed that a Wikipedia outage was linked to the patching work, and Japan's prime minister publicly urged website owners to install the fix.mashable.com

A five-stage framework

The OpenAI proposal has five stages. First, validate the bug and fix it upstream. Next, give affected organizations time to prepare and bring in government partners, which in the PHP case included the White House's Super Intelligence Force, the Office of the National Cyber Director and CISA. After that, prepare updates across downstream products, then publish guidance once a patch ships. Under the plan, maintainers decide who gets early notice, based on each organization's protective role, how long it needs to act and whether it can handle sensitive information, Help Net Security reported.helpnetsecurity.com+1

OpenAI also committed $1 billion in subsidized access to Daybreak, its security tool, for under-resourced organizations that protect essential services. It is asking for feedback on how long disclosure windows should be, and on whether governments should scan the internet and patch vulnerable systems themselves.

The company said PHP will not be the last case like this. "As significant as they are, these bugs are among several significant vulnerabilities we've already found and are working to fix, and we expect similar findings to increase sharply in the coming months," OpenAI wrote.openai.com