IT之家 Reported on October 22: OpenAI announced in a blog post yesterday (October 21) that, through its “Patch the Planet” program, it helped security researchers discover two critical vulnerabilities in the PHP programming language,and worked with the PHP maintenance team, security firms, cloud providers, and cybersecurity agencies from multiple countries to complete about two months of coordinated remediation before the vulnerabilities were disclosed.
The security firm Calif used OpenAI's GPT-5.6 Sol model to discover one of the critical flaws; Google-owned Wiz independently discovered and reported the related vulnerabilities. PHP's official maintainers led vulnerability validation, fix development, and release, while OpenAI, Wiz, Cloudflare, and others provided research, technical support, and cross-organization coordination so that protection preparations could be completed before public disclosure.
OpenAI said this is a case of frontier AI discovering high-severity vulnerabilities before attackers, securing for maintainers and defenders a so-called “defender's window.” However, the company also acknowledged that the same AI capabilities could be used by attackers to develop attack tools and exploit code faster, with security risks and defensive value coexisting.
As IT之家 previously reported, the two vulnerabilities disclosed this time are collectively known as “PHP2Shell,”numbered CVE-2026-109618 and CVE-2026-109619with a CVSS v4.0 score of 9.2 for both.
PHP is an open-source scripting language that powers a vast number of websites and web applications worldwide, and industry estimates suggest about 70% of websites rely on it to run.These vulnerabilities could allow unauthenticated attackers to execute code remotely, and thereby tamper with website content, read sensitive data, or compromise servers.The PHP Foundation released emergency security updates on October 21, with fixed versions including PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
To help operators assess their risk, OpenAI has released a PHP version check tool as a Codex skill, allowing operations staff to identify potentially affected PHP versions and, combined with official upgrade guidance, determine the appropriate remediation.
OpenAI recommends that organizations using PHP apply the patches as soon as possible, check their systems' exposure, and follow CISA's risk prioritization guidance to take emergency patching, temporary mitigation, or planned upgrades.
OpenAI also announced it will invest 1 billion US dollars (IT之家 note: approximately 6.691 billion RMB at the current exchange rate) through “Daybreak for Frontline Defenders” to provide subsidized access to organizations with limited security resources that run critical services, helping them use AI for vulnerability discovery, system monitoring, and incident response.
The company also proposed a vulnerability response framework for the AI era, covering five phases: upstream validation and fixes, advance notification of affected organizations, government collaboration, cross-product update preparation, and deployment support after patch release.
Further reading: