OpenAI Helps Patch Critical PHP Flaws Affecting 70% of Web
OpenAI coordinated the discovery and patching of two critical remote code execution vulnerabilities in PHP (CVSS 9.2), affecting ~70% of websites worldwide. This initiative highlights AI's defensive capabilities in finding flaws before attackers, accompanied by a $1 billion commitment to support frontline defenders.
Full Report
On October 22, OpenAI announced in a blog post yesterday (October 21) that through its "Patch the Planet" initiative, it assisted security researchers in discovering two critical vulnerabilities in the PHP programming language. In collaboration with the PHP maintenance team, security firms, cloud service providers, and cybersecurity agencies from multiple countries, coordinated remediation was completed over a period of approximately two months before public disclosure.
Security firm Calif identified one of the key flaws using OpenAI's GPT-5.6 Sol model; Wiz, a subsidiary of Google, independently discovered and reported related vulnerabilities. Official PHP maintainers led vulnerability verification, fix development, and version releases, while OpenAI, Wiz, Cloudflare, and others provided research, technical support, and cross-organizational coordination to ensure defensive preparations were in place prior to public disclosure.
OpenAI stated that this represents a case where frontier AI discovered high-severity vulnerabilities before attackers could exploit them, creating what is known as a "defender's window" for maintainers and defenders. However, the company acknowledged that similar AI capabilities could be used by attackers to develop exploit tools and attack vectors more rapidly, meaning security risks and defensive value coexist.
As previously reported by IT Home, the two disclosed vulnerabilities are collectively referred to as "PHP2Shell," assigned CVE IDs CVE-2026-109618 and CVE-2026-109619, both scoring 9.2 on the CVSS v4.0 scale.
PHP is an open-source scripting language supporting a vast number of websites and web applications globally, with industry estimates suggesting that approximately 70% of websites rely on it. These vulnerabilities could allow unauthenticated attackers to execute code remotely, potentially leading to website content tampering, sensitive data theft, or server compromise. The PHP Foundation released emergency security updates on October 21, with patched versions including PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
To help operators assess risk, OpenAI has released a PHP version checking tool as a Codex skill, enabling operations personnel to identify potentially affected PHP versions and determine appropriate remediation steps based on official upgrade guidelines.
Organizations recommended by OpenAI to use PHP are advised to apply patches immediately, check system exposure, and follow CISA’s risk prioritization guidelines to implement urgent patching, temporary mitigations, or planned upgrades.
OpenAI also announced a $1 billion investment (IT Home note: equivalent to approximately 6.691 billion RMB at current exchange rates) through "Daybreak for Frontline Defenders." This initiative will provide subsidized access to organizations with limited security resources but responsible for critical services, helping them leverage AI for vulnerability discovery, system monitoring, and incident response.
Additionally, the company proposed a vulnerability response framework tailored for the AI era, covering five phases: upstream validation and remediation, early notification of affected entities, government collaboration, cross-product update preparation, and post-patch deployment support.