OpenAI helps uncover critical PHP vulnerabilities affecting millions of websites

OpenAI has helped coordinate an international cybersecurity response to two critical vulnerabilities in PHP, a programming language used by roughly 70% of websites. Researchers used advanced AI models to uncover security flaws that could allow attackers to take control of affected servers.

The company announced Wednesday that its Patch the Planet initiative brought together PHP maintainers, cybersecurity researchers and infrastructure providers, including Wiz and Cloudflare, to develop fixes and prepare protections before public disclosure.

Security firm Calif identified one of the vulnerabilities using OpenAI’s GPT-5.6 Sol model, while Wiz independently discovered and reported both flaws using a combination of AI tools.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, received critical severity scores of 9.2 out of 10 and could allow unauthorized attackers to execute malicious code or expose sensitive information on vulnerable servers.

PHP releases emergency security patches

The disclosure coincided with an emergency security update released Wednesday, October 21, addressing the vulnerabilities affecting PHP installations dating back to version 5.4.

PHP developers released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, urging administrators to install the patches immediately. Older unsupported versions will not receive official fixes.

The vulnerabilities, collectively known as PHP2Shell, affect the core PHP engine rather than a specific website application, potentially exposing servers running widely used platforms such as WordPress and Drupal.

According to Wiz Research, successful exploitation could allow attackers to access sensitive data, modify websites or execute commands remotely without authentication.

The severity of the vulnerabilities prompted cybersecurity agencies to recommend immediate updates, while some organizations temporarily took websites offline as a precaution.

Cloudflare said it had already deployed firewall protections ahead of the public disclosure and observed attempts to exploit the vulnerabilities as details began circulating.

OpenAI proposes coordinated response to AI discovered vulnerabilities

OpenAI said the PHP investigation demonstrates how increasingly capable AI systems can identify security weaknesses that have remained undetected for years, while also raising concerns that similar capabilities could help attackers develop exploits more rapidly.

The company described the period between AI assisted discovery and potential malicious exploitation as a window for defenders to coordinate security updates before vulnerabilities become widely known.

Through Patch the Planet, OpenAI is proposing a broader framework for responding to critical software vulnerabilities, bringing together maintainers, cybersecurity companies, infrastructure providers and government agencies.

The framework includes validating vulnerabilities, developing fixes, preparing protective measures for affected organizations and coordinating public disclosure once security updates are available.

OpenAI also committed $1 billion in subsidized access to its Daybreak cybersecurity tools through its Frontline Defenders initiative, targeting organizations with limited security resources.

The company said it expects AI assisted vulnerability discoveries to increase substantially in the coming months, making faster coordination between researchers and software maintainers increasingly important.