Critical PHP Vulnerabilities Discovered Through AI-Human Collaboration

Two critical vulnerabilities in PHP, a programming language powering approximately 70% of the world’s websites, have been identified through a collaborative effort combining artificial intelligence and human expertise. On October 21, 2026, OpenAI announced that it had coordinated with researchers and cybersecurity specialists to remediate these flaws prior to their public disclosure.

The "Patch the Planet" Initiative

The project leveraged GPT-5.6 Sol, OpenAI’s advanced model, as part of the "Patch the Planet" initiative. Notably, the cybersecurity firm Wiz independently discovered and reported the same two vulnerabilities. The PHP core team led the development of the fixes, with significant support from OpenAI, Wiz, and Cloudflare.

These vulnerabilities allowed attackers to remotely access web servers without authentication, posing severe risks of data theft, data modification, and the compromise of interconnected systems. The potential impact is substantial, given that PHP underpins major platforms such as WordPress and Drupal.

Immediate Actions for Enterprises

For businesses, the immediate priority is to audit their systems and apply the appropriate security updates. Organizations using PHP directly or via their hosting providers must:

Identify affected PHP versions.
Verify available patches.
Ensure that updates have been successfully deployed.

To facilitate this process, OpenAI has released a tool designed to scan for potentially vulnerable PHP versions.

A Paradigm Shift in Cybersecurity

This incident highlights a major shift in the cybersecurity landscape: AI can accelerate the detection of long-standing, difficult-to-exploit flaws. However, the same capabilities can also empower cybercriminals to develop attacks more rapidly. Therefore, discovery alone is insufficient. The speed of validation, coordination between researchers and software vendors, and the effective deployment of patches are now critical factors in mitigating risk.

Expanding Access to AI-Driven Defense

In response to the increasing pace of vulnerability discovery, OpenAI has announced a $1 billion commitment to provide subsidized access to its Daybreak tools. This initiative is specifically aimed at organizations with limited resources for system protection, with the goal of broadening access to AI-assisted defensive capabilities.