OpenAI says its models helped discover critical PHP security vulnerabilities

Wired AI

PHP2Shell vulnerability incident shows AI makes old vulnerabilities easier to exploit

WIRED reported that the newly disclosed PHP vulnerabilities are collectively called PHP2Shell, and within hours of disclosure Cloudflare recorded millions of exploitation attempts, but the PHP Foundation said it has not yet seen a successful exploit. Researchers at security firm Calif, using frontier models from OpenAI's Patch the Planet project combined with PHP expertise, first discovered and constructed an exploit in early August, and researchers from OpenAI and Google's Wiz subsequently also independently discovered similar vulnerabilities using AI. Multiple researchers believe AI has not introduced entirely new attack methods, but has amplified the existing pace of vulnerability discovery and disclosure.

Fortune AISelected

OpenAI model finds PHP vulnerability affecting about 70% of websites

In August 2026, researchers at security research firm Calif used an advanced OpenAI AI model to discover a vulnerability in the PHP core system. The vulnerability affects about 70% of websites, and attackers can use it to gain shell access to servers; the related exploit code is called PHP2Shell. The vulnerability information leaked before the PHP organization released a patch, and AWS said hackers had begun "widespread" attempts to exploit it. The article points out that AI can analyze massive codebases in hours or days and find flaws that manual audits might miss, but attackers can also use the same reasoning capabilities to scan for and automate the exploitation of vulnerabilities.

The Paper

PHP exposed two high-severity vulnerabilities, hackers attempted millions of attacks, industry says AI is accelerating the imbalance between offense and defense

Two serious security vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, were publicly disclosed, allowing unauthenticated attackers to achieve remote code execution through specially crafted POST requests. Cloudflare and Amazon said hacker attack attempts have surged to millions, and banks, airlines, and government websites in multiple countries urgently went offline. On October 22, the Cybersecurity Threat and Vulnerability Information Sharing Platform of the Ministry of Industry and Information Technology advised relevant units to immediately investigate and upgrade to the latest security version. Several security professionals told The Paper that AI has compressed the discovery of high-severity vulnerabilities to minutes or even tens of seconds, but remediation capabilities have not kept pace, and the defenders' rhythm of waiting for patches before upgrading has become ineffective.

CNN Business Tech

AI finds a 22-year-old PHP vulnerability within two days; OpenAI and security firms jointly disclose it and release a patch

AI security firm Calif and OpenAI's Patch the Planet initiative used a large language model to find an exploit for a 22-year-old PHP vulnerability within two days, and the related patch was released on Wednesday. The vulnerability can cause residual data to be read after server memory is exhausted or allow malicious code to be executed, and Google-backed Wiz also discovered a new PHP exploitation method. Cloudflare said the vulnerability was suspected to have leaked before the patch was released, with thousands of exploitation attempts appearing within hours, and CrowdStrike warned that a large number of old PHP versions are still running.

Caixin

PHP exposed two high-severity vulnerabilities enabling unauthenticated remote code execution, affecting about 70% of websites worldwide

On October 21, the official PHP website stated that two critical vulnerabilities had been discovered that enable unauthenticated remote code execution, codenamed PHP2Shell in the industry, and it is estimated that about 70% of websites worldwide are built with PHP. OpenAI said in a post the same day that the vulnerabilities were discovered by AI security company Calif with the help of GPT-5.6 Sol; frontier AI discovered this batch of vulnerabilities before attackers, buying a defensive window for maintainers and security service providers. The China National Vulnerability Database (CNVD) recommends that affected users immediately upgrade to the latest version.

Business Insider Tech

Mave raises $34 million to use AI agents to help security teams counter AI threats

Israeli cybersecurity startup Mave has completed a $34 million funding round, including $28 million in Series A led by Red Dot Capital Partners and $6 million in seed funding. Its AI agents can integrate information from enterprises' existing security systems, investigate alerts, filter out false positives, and execute actions approved by human teams. Mave currently has 30 employees and plans to use part of the new funding to expand its go-to-market team and AI research.

Cailian Press

OpenAI sends letter to California Governor Newsom, recommending strengthening of AI transparency bill SB53

In an October 20 letter to California Governor Newsom, Chan Park, OpenAI's Head of Policy and Partnerships for the U.S. and Canada, said that OpenAI supports imposing mandatory requirements on AI companies, including equipping models with emergency shutdown mechanisms, undergoing independent audits annually, implementing higher-standard cybersecurity norms, and recommended strengthening SB53, California's AI transparency bill that took effect in 2025. The letter proposed that regulatory rules should make clear that corporate safety frameworks must cover the ability of frontier models to autonomously conduct AI research and development. OpenAI had publicly opposed overly burdensome state-level legislation during the SB53 legislative process, and has now shifted its position.

Zhidongxi

OpenAI helped discover two PHP remote code execution vulnerabilities; PHP releases four versions to fix them

OpenAI disclosed that its participation in security research helped discover two severe PHP vulnerabilities; under specific conditions, attackers could execute code on affected servers without authentication, with both receiving a CVSS 4.0 score of 9.2. The PHP project released four maintenance versions—PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35—on October 21 to complete the fix, and the official recommendation is to upgrade as soon as possible. This investigation was supported by OpenAI's Patch the Planet project; the PHP Foundation said that since July 1, the team has published 15 CVE advisories while also handling more than 100 invalid or duplicate reports.

36Kr · AI

PHP Exposes Two High-Severity Vulnerabilities Rated 9.2; GPT-5.6 Sol Participated in Discovery

PHP has exposed two high-severity vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with a severity rating of 9.2. In the worst case, attackers can execute code remotely without logging in, and almost all versions since PHP 5.4 are affected. The official fix versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been released, and PHP 8.1 and earlier versions are no longer supported. OpenAI said that the security company Calif, under the Patch the Planet initiative, used GPT-5.6 Sol to discover one of the critical vulnerabilities, while Wiz also independently discovered and reported both vulnerabilities. OpenAI led coordination of the patch with PHP maintainers, Wiz, and Cloudflare.

Phoenix Tech

OpenAI discloses that GPT-5.6 Sol found two high-severity vulnerabilities in PHP

OpenAI publicly stated that GPT-5.6 Sol discovered two high-severity vulnerabilities in the PHP engine, collectively called PHP2Shell, both with a CVSS score of 9.2; in affected deployments, attackers may be able to make the server execute malicious code without logging in. Wiz independently reproduced the unauthenticated remote attack and verified a path for reading passwords, tokens, and API keys from memory; 69.3% of websites whose server-side language W3Techs can identify use PHP. PHP maintainers led the fix and have released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; OpenAI also released a Codex check skill for determining whether a PHP version may be affected.

The DecoderSelected

OpenAI GPT-5.6 Sol and Google Gemini 4 Argon Discover PHP Vulnerability Affecting Millions of Websites

OpenAI's GPT-5.6 Sol discovered a critical PHP vulnerability affecting millions of websites in the Patch-the-Planet initiative, while security firm Wiz independently discovered the same batch of vulnerabilities using its self-developed Wiz Atlas platform together with Gemini 4 Argon and GPT-5.6 Sol. Wiz said Gemini 4 Argon was particularly useful in vulnerability discovery, exploit development, attack detection construction, and patch verification, and tools are already available on GitHub for server operators to check whether their PHP versions are affected. The fix took two months and was coordinated in five phases, with participants including PHP developers, Wiz, Cloudflare, and U.S. agencies such as CISA and the White House; OpenAI expects the scale of such discoveries to increase substantially in the coming months and cautions that the same capabilities could also be exploited by attackers.

TechCrunch AI

Government websites worldwide go offline due to a PHP vulnerability, while Node.js, LiteLLM and others disclose security issues on the same day

After AI discovered a critical security vulnerability in PHP, government websites in many countries around the world went offline, and the U.S. National Security Agency recommended that organizations using PHP update immediately or temporarily take their systems offline. On the same day, Node.js fixed four high-severity vulnerabilities, one of which allows remote code execution; the open-source LLM request proxy LiteLLM was hit by attackers who injected malicious code, and the malicious versions were published to PyPI, Docker Hub and GHCR, containing an information stealer that harvests cloud credentials, passwords and AI service credentials as well as a remote access trojan. LiteLLM said it has removed the malicious versions and images. In addition, the private key of the Indian certificate authority eMudhra was compromised, and security professionals say the cleanup effort will be larger than that of Heartbleed.

Fortune AI

AI tools discovered a PHP vulnerability affecting 70% of the internet, and the PHP Foundation released an emergency patch

The PHP Foundation disclosed two critical vulnerabilities collectively known as php2shell, CVE-2026-109618 and CVE-2026-109619, and released emergency patches, requiring websites to update immediately or temporarily go offline. OpenAI said its GPT-5.6 Sol participated in discovering the vulnerabilities, while Wiz independently found the same issue in August by combining Gemini 4 Argon, GPT-5.6 Sol, and Wiz Atlas, after which the parties coordinated with the PHP Foundation to complete remediation and disclosure. Cloudflare has observed early attack attempts, and a preliminary analysis by Palo Alto Networks identified 22.6 million potentially affected instances.

CNN Business TechSelected

OpenAI, Wiz and Calif use AI to discover PHP2Shell vulnerabilities affecting 70% of the internet

Research teams from OpenAI, Wiz and Calif used AI to discover and address a set of critical vulnerabilities named PHP2Shell, which they say could affect 70% of the internet. The research used Google's Gemini 4 Argon, Wiz Atlas and OpenAI's GPT-5.6 Sol; the vulnerabilities were discovered at the end of August and made public on Wednesday after the PHP Foundation released patches. Wiz researchers said that with frontier AI models and the right tools, a single researcher completed in one week work that previously took world-class teams months, and compared the issue to Heartbleed in 2014.

OpenAIFirst-partySelected

OpenAI packages Codex skill to check whether websites are affected by PHP vulnerabilities

OpenAI releases a Codex skill for checking whether websites are affected by the PHP security vulnerability it disclosed; users can point Codex at a specified repository and follow the guidance to complete the troubleshooting. The vulnerability was discovered by OpenAI models under the Patch the Planet program and involves PHP, the open-source language running about 70% of websites; fixing it requires major changes to the PHP engine. Sites using PHP can currently upgrade versions and combine this with mitigation measures from security vendors.

ethan_mollick

English translation is being prepared.

cnBetaSelected

OpenAI discloses that GPT-5.6 Sol discovered a critical PHP vulnerability and releases a coordinated response framework

OpenAI says security firm Calif used GPT-5.6 Sol to discover a critical PHP vulnerability, Wiz independently reported two other related vulnerabilities, and the PHP development team released a fix on October 21 and urged users to upgrade. Based on this, OpenAI proposes a five-stage coordinated response framework for critical vulnerabilities covering vulnerability validation, phased information sharing, coordination with government agencies, broadening participation, and publishing remediation guidance, and calls the preparation period before public disclosure the "defender's window." OpenAI will also provide a PHP version check tool, plans to launch a companion Codex skill, and through the "Daybreak for Frontline Defenders" program will offer $1 billion in subsidized Daybreak service access credits.

wired_ai

English translation is being prepared.

Peter SteinbergerSelected

Peter Steinberger reposted OpenAI, saying that GPT-5.6 Sol discovered a high-severity PHP vulnerability

Peter Steinberger reposted OpenAI's message, saying that the PHP vulnerability set to cause chaos this week was discovered by GPT-5.6 Sol. OpenAI said its model, as part of the Patch the Planet initiative, helped researchers discover critical security flaws in PHP, which is estimated to be used to run about 70% of websites; over the past two months, OpenAI worked with maintainers, researchers, and security vendors to prepare fixes and protections, the fix involved major changes to the PHP engine, and all sites using PHP can now upgrade to stay secure.

OpenAIFirst-partySelected

OpenAI says its model helped discover a critical PHP security vulnerability

OpenAI stated that its model helped researchers discover a critical security vulnerability in PHP under the Patch the Planet initiative; PHP is estimated to be used to run about 70% of websites. Over the past two months, OpenAI led an alliance of maintainers, researchers, and security vendors to prepare fixes and protections before the vulnerability was disclosed, because remediation was complex and required significant changes to the PHP engine. OpenAI said all sites using PHP can now upgrade versions to stay secure, and considers this one of the most impactful vulnerabilities in recent times and a new phase in which AI can discover security vulnerabilities at internet scale.

bbc_technology

English translation is being prepared.