OpenAI announced it has identified critical vulnerabilities in PHP, a widely-used open-source programming language that powers websites and web applications, through its Patch the Planet initiative using GPT-5.6 Sol. Security firm Wiz independently discovered and reported the same vulnerabilities.
According to OpenAI, this represents “one of the most impactful security issues in recent memory” due to PHP’s widespread deployment. The company notes that frontier AI discovered these vulnerabilities before attackers did, creating what it calls a “Defender’s Window” for maintainers and security providers to prepare fixes and protections ahead of public disclosure.
The response involved a coalition including PHP maintainers, researchers, and security providers like Wiz, Cloudflare, and others who contributed research, technical support, and coordination. PHP’s maintainers led the fixes and release process.
OpenAI has committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, targeting organizations with limited security resources that protect essential services.
The company proposed a five-stage framework for responding to critical vulnerabilities in widely-used software: validating and fixing upstream vulnerabilities; giving affected organizations time to act; coordinating with government partners to protect critical systems; preparing updates across affected products; and publishing guidance to support deployment.
The response included engagement with multiple U.S. government agencies including the White House’s Super Intelligence Force, the Office of the National Cyber Director, and the Cybersecurity and Infrastructure Security Agency (CISA), as well as international partners.
OpenAI released a PHP version checker as a Codex skill to help operators identify potentially vulnerable PHP versions and determine which updates apply. The Patch the Planet website consolidates public disclosures and guidance to help operators identify affected systems and verify fixes are running.
OpenAI acknowledged that the same AI capabilities used to discover vulnerabilities can also help attackers rapidly develop offensive tools and exploits. The company expects similar security findings to increase sharply in coming months and called on the security community to help improve the proposed coordination framework.
Key facts
- OpenAI used GPT-5.6 Sol to identify critical PHP vulnerabilities through its Patch the Planet initiative
- Security firm Wiz independently discovered the same vulnerabilities
- OpenAI committed $1 billion in subsidized Daybreak access for organizations protecting essential services
- The response involved coordination with PHP maintainers, Wiz, Cloudflare, and U.S. government agencies including CISA
- OpenAI proposes a five-stage framework for coordinating responses to critical vulnerabilities in widely-used software