OpenAI-led coalition discloses critical PHP flaws and proposes an AI-era response playbook

On October 21, OpenAI published an account of a PHP vulnerability response it coordinated over the past two months. PHP runs a large share of the web, so fixes to the language ripple out to hosting providers, distributors, and downstream products rather than stopping at a single project.

According to OpenAI, its team found a critical flaw using frontier models under the Patch the Planet initiative, while security firm Wiz independently discovered and reported both vulnerabilities. PHP's maintainers led the fixes and the release, with Wiz, Cloudflare and other partners contributing research, technical support and coordination so protections were ready before disclosure.

OpenAI called the flaws, given their severity and PHP's reach, among the most impactful security issues in recent memory. It also named the tension at the center of the story: AI can surface defects at internet scale, and the same capability lets attackers build offensive tooling and exploits quickly.

What shaped this episode was not the bug itself but the gap between how fast it was found and how fast it could be fixed. OpenAI said that, to its knowledge, frontier AI found these vulnerabilities before attackers did, opening a defender's window in which maintainers and security providers could prepare fixes and mitigations ahead of disclosure.

To widen access to that capability, OpenAI described subsidized access for organizations with limited security resources that protect essential services, alongside continued tooling support for open-source maintainers.

The substance of the post is a five-stage framework: validate and fix the upstream vulnerability, including adversarial testing with frontier models to look for ways around the patch; give affected organizations time to act; coordinate with government partners to protect critical systems; prepare updates across affected products; and, once a patch exists, publish guidance and support deployment. OpenAI said it engaged multiple parts of the U.S. government and international partners so guidance could reach critical infrastructure operators.

On tooling, OpenAI released a PHP version checker and will ship an accompanying Codex skill to help operators identify potentially vulnerable versions and work out which updates apply, alongside maintainers' and providers' own guidance. The Patch the Planet site collects disclosures, official upgrade instructions and partner research, and also covers interim mitigations, backup and recovery.

OpenAI is now asking the security community to stress-test the framework, with questions about how long disclosure windows should be, when active exploitation or a leaking patch should trigger earlier disclosure, and how downstream packages stay secure-by-default while upstream fixes are pending. It expects similar high-severity findings to increase sharply in the coming months, which is why it wants the response process standardized now.