On the 21st, OpenAI published a post saying that, through its "Patch the Planet" program, it helped security researchers uncover two critical vulnerabilities in the PHP language, and together with the maintainers, security companies, cloud vendors, and cybersecurity agencies from multiple countries, completed roughly two months of coordinated remediation before public disclosure.
The two vulnerabilities are collectively named "PHP2Shell," designated CVE-2026-109618 and 109619, both scoring 9.2 under CVSS v4.0. Security company Calif discovered one critical flaw with the help of OpenAI's GPT-5.6 Sol model, while Google's Wiz independently reported it; PHP's official maintainers led verification, remediation, and release, with OpenAI, Wiz, Cloudflare, and others providing research, technical support, and cross-organization coordination. OpenAI said this is an example of frontier AI discovering high-severity vulnerabilities before attackers, winning defenders a "defender's window," but the same capability could also be exploited at accelerated pace by attackers.
70% of websites affected, patches released
PHP is an open-source scripting language that supports a vast number of websites, with industry estimates suggesting about 70% of websites rely on it to run; this vulnerability allows unauthorized attackers to execute code remotely, tamper with content, steal data, and even compromise servers. The PHP Foundation released emergency updates on the 21st, with fixed versions covering 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
To help operations teams investigate, OpenAI launched a PHP version checking tool; it also announced an investment of $1 billion to subsidize AI security capabilities for organizations with limited resources that safeguard critical services through "Daybreak for Frontline Defenders." This AI-driven global coordinated defense is pushing vulnerability response into a new rhythm of "staying ahead of attackers."