Over the past two months, OpenAI led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications. OpenAI's GPT-5.6 Sol identified one critical flaw as part of its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities. PHP's maintainers led the fixes and release, with partners such as Wiz and Cloudflare contributing research, technical support, and coordination to prepare protections ahead of disclosure.
For organizations using PHP, the priority is applying the fixes. OpenAI is sharing a PHP version checker as a Codex skill to help operators identify potentially vulnerable versions and determine which updates apply, alongside PHP's and their providers' guidance. Given the severity of these flaws and PHP's widespread use, OpenAI considers this one of the most impactful security issues in recent memory.
The case highlights how AI can uncover security flaws with internet-scale impact, while the same capabilities could help attackers rapidly build offensive tools and exploits. To OpenAI's knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender's Window for maintainers and security providers to prepare fixes and protections. OpenAI has also committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, focused on organizations with limited security resources protecting essential services.
These bugs are among several significant vulnerabilities OpenAI has already found, and it expects similar findings to rise sharply in the coming months. OpenAI is proposing a five-stage framework for responding to critical vulnerabilities in widely used software, beginning with validating and fixing the upstream flaw, and is asking the security community to help improve it.
Source: OpenAI Blog · Summarized by HeadlinesBriefing