AI finds critical PHP flaws, triggers global patch response

AI uncovers critical PHP vulnerabilities

OpenAI reports that Calif, an internal team using GPT‑5.6 Sol as part of its Patch the Planet initiative, identified a critical flaw, with Wiz also independently discovering and reporting both vulnerabilities ¹. Wiz, a separate security firm, also independently found and reported both vulnerabilities .

A coordinated global response

PHP maintainers led the fixes and release process ¹. OpenAI provided security expertise and model access to test patches and prepare guidance . Partners including Cloudflare, Wiz, government agencies — among them CISA and the White House's Super Intelligence Force — and international collaborators all contributed to the response . The coordination aimed to prepare protections before the vulnerabilities were made public .

Why it matters

The vulnerabilities are among the most impactful security issues OpenAI has encountered ¹. However, the company acknowledges the same AI capabilities could also help attackers rapidly build offensive tools and exploits .

What's being done next

OpenAI released a PHP version checker as a Codex skill to help operators identify vulnerable installations ¹. It also proposed a five-stage framework for responding to critical vulnerabilities in widely used software during the AI era: validate and fix upstream, give organizations time to act, coordinate with government partners, prepare updates across products, and publish guidance after disclosure . The company committed $1 billion in subsidized access to its Daybreak models through a program for frontline defenders with limited security resources .

Looking ahead

These bugs are just some of several significant vulnerabilities OpenAI has found and is working to fix, and the company expects similar findings to increase sharply over the coming months ¹. OpenAI is asking the security community to help improve its proposed response framework as AI capabilities continue to advance .

Corrections and updates

Corrected on 22 October 2026. An earlier version said millions of websites could be affected; the source describes PHP as widely used and the flaws as severe but does not cite a specific number of websites affected.

Key facts

OpenAI and Wiz independently discovered two critical PHP vulnerabilities using AI-assisted research
Frontier AI models found the flaws before attackers, creating a Defender's Window
OpenAI committed $1 billion in subsidized Daybreak model access for frontline defenders
A five-stage coordination framework was proposed for future vulnerability responses
Expectations are that similar AI-discovered vulnerabilities will increase sharply in coming months