OpenAI says its AI found critical PHP security flaws
What's the story
OpenAI has revealed that its artificial intelligence (AI) models played a key role in discovering the critical PHP security flaws, which have been wreaking havoc on websites across the globe. The company made the announcement in a blog post on Wednesday, detailing its two-month-long effort in leading a coalition of PHP maintainers, security researchers, and companies to address these vulnerabilities.
Impact assessment
Bugs could let hackers take control of servers running PHP
The newly discovered vulnerabilities could let hackers take control of servers running PHP, the programming language that powers a large portion of the web.
OpenAI has termed these bugs as one of the most significant security issues in recent memory.
The issue has been dubbed "PHP2SHELL" by those working on it, and was first discovered by security firm Calif using OpenAI's GPT-5.6 Sol model as part of its Patch the Planet program.
Collaborative effort
Coalition working on fixes for vulnerabilities
The coalition, led by OpenAI, has been working on fixes for these vulnerabilities.
OpenAI, Wiz, Cloudflare, and other partners have contributed research and helped prepare protections before the flaws went public.
The issue had existed in PHP for 14 years but was only partially discovered in 2024. A more complete version of the bug was found by OpenAI's own team in September and independently by Calif in August.
Early disclosure
Earlier leak could have caused far more damage
The coalition had planned to disclose the flaws on October 22, but details leaked early. PHP's maintainers released the fixes a day earlier.
OpenAI President Greg Brockman said the two months of preparation was crucial as the fixes were complicated and an earlier leak could have caused far more damage.
The company also worked with US government agencies on the response, including White House's Super Intelligence Force and Cybersecurity and Infrastructure Security Agency.
Future predictions
OpenAI expects bug discoveries to increase sharply
OpenAI has already discovered several other serious vulnerabilities and expects similar findings to increase sharply in the coming months.
This year, new AI models like GPT-5.6-Sol and Claude Mythos have led to a spike in bug discoveries.
Brockman criticized the current method of handling such bugs as "slow and manual," which won't scale as AI gets better at finding them.
Proposal
Proposed new process for coordinating disclosures
OpenAI is now seeking feedback from the security community on a proposed new process for coordinating disclosures.
One idea is to have governments or other authorized defenders continuously scan the internet for vulnerable systems. They would alert site owners when they find one and, in extreme cases, patch the systems themselves.
However, OpenAI also acknowledges that these same AI capabilities could help attackers develop exploits faster.