OpenAI Coordinates Fixes for Critical PHP Vulnerabilities

OpenAI says it spent the past two months leading a coalition of maintainers, researchers and security providers to fix critical vulnerabilities in PHP, the open-source language used to run websites and web applications, in a post on its website. Security firm Calif found a critical flaw using GPT-5.6 Sol as part of OpenAI's Patch the Planet initiative, and Wiz independently discovered and reported both vulnerabilities. Wiz says PHP powers 70% of websites and that successful exploitation could let attackers take control of affected servers, steal data and deface sites.

PHP's maintainers led the fixes and the release, with OpenAI, Wiz, Cloudflare and others preparing protections before disclosure. OpenAI called it "one of the most impactful security issues in recent memory" and said organizations using PHP should apply the fixes now. It is sharing a PHP version checker as a Codex skill.

OpenAI said frontier AI found these vulnerabilities before attackers did, but warned the same capabilities can help attackers build exploits. It has committed $1 billion in subsidized Daybreak access, through Daybreak for Frontline Defenders, for organizations with limited security resources that protect essential services, and says it expects similar findings to "increase sharply in the coming months."

The company is also proposing a framework for responding to critical vulnerabilities in widely used software and asking the security community to help improve it.