OpenAI coordinates fixes for critical PHP flaws

OpenAI said it spent the past two months leading a coalition of maintainers, researchers and security providers to address critical vulnerabilities in PHP, the open-source language that runs a large share of websites and web applications.

Security firm Calif found one critical flaw using GPT-5.6 Sol as part of OpenAI's Patch the Planet initiative. Wiz independently discovered and reported both vulnerabilities. PHP's maintainers led the fixes and the release. Wiz, Cloudflare and others contributed research, technical support and coordination so protections were ready before disclosure. OpenAI did not name the specific flaws or affected versions in the post. It released a PHP version checker as a Codex skill to help operators find vulnerable installations.

OpenAI called the bugs "one of the most impactful security issues in recent memory." To its knowledge, frontier AI found them before attackers did. It added that the same capabilities could help attackers build exploits quickly. The company said these are among several significant vulnerabilities it has found and is working to fix, and it expects such findings to "increase sharply in the coming months."

OpenAI also proposed a five-stage response framework and asked the security community for feedback:

• validate the bug and fix it upstream, including adversarial testing with frontier models
• give selected organizations advance notice
• coordinate with governments
• prepare updates across affected products
• publish guidance and support deployment

For PHP, OpenAI worked with the White House's Super Intelligence Force, the Office of the National Cyber Director (ONCD) and CISA, as well as international partners.

Separately, OpenAI committed $1 billion in subsidized access to Daybreak for under-resourced organizations that protect essential services.