Abstract:
OpenAI issued an announcement on October 21, 2026, disclosing its participation in the discovery and coordination of the repair of two serious security vulnerabilities in the PHP programming language. This action is promoted by the "Patch the Planet" (patch the entire Internet) program launched by OpenAI, which unites software maintainers, security researchers, cloud service providers and government network security agencies to jointly reduce the risks caused by vulnerabilities to the global Internet infrastructure.
OpenAI stated that advanced artificial intelligence models have been able to discover software security flaws with a wide range of impacts, and how to quickly transform these findings into actual protective measures is becoming an increasingly important topic in the field of network security.
In this incident, security company Calif discovered a serious security flaw using GPT-5.6 Sol, and security company Wiz independently discovered and reported two related vulnerabilities. The PHP maintenance team is responsible for leading vulnerability fixes and security version releases, while OpenAI, Wiz, Cloudflare and other partners provide technical research, engineering support and coordination to help relevant organizations prepare for protection before vulnerabilities are made public.
PHP is an open source programming language widely used in websites and network applications. A large number of Internet services rely on it to handle web page requests, database operations and background business logic. Therefore, there is a serious vulnerability in the bottom layer of PHP, and the impact may quickly spread to many websites, cloud services and enterprise systems. Both vulnerabilities discovered this time are rated as critical and could allow an attacker to remotely execute code without authentication. The PHP development team has released a fix version on October 21 and urges users to upgrade immediately.
OpenAI stated that this incident highlights the dual role of artificial intelligence in the field of network security. On the one hand, advanced models can help researchers discover flaws that have been hidden in mature software for a long time; on the other hand, the same capabilities may also be used by attackers to quickly develop exploit tools and attack programs. Therefore, the security team cannot only focus on whether the vulnerability can be discovered, but must also establish an efficient mechanism to ensure that the vulnerability is repaired in a timely manner and reduce the risk of attack as much as possible before the relevant patches are deployed.
OpenAI stated that according to the information it currently has, the vulnerability was discovered with the help of advanced artificial intelligence before the attacker discovered and exploited it. This buys valuable defense preparation time for software maintainers. The company calls this phase the “Defender’s Window,” which is the window of time during which defenders can identify problems, develop remediation plans, and deploy protective measures before attackers do.
However, this window will not always exist. As the capabilities of artificial intelligence models continue to improve, the time gap between discovering vulnerabilities and developing attack methods may gradually shorten. OpenAI believes that the cybersecurity industry needs to shift from a relatively decentralized vulnerability handling approach in the past to a systematic response mechanism that can quickly coordinate software maintainers, service providers, enterprise operators, and government agencies.
To this end, OpenAI has proposed a coordinated response framework for serious vulnerabilities, which mainly includes five stages.
First, software maintainers, researchers, and key technology partners need to work together to verify vulnerabilities, assess their scope, and develop and test fixes. At this stage, the team should also use advanced models to conduct adversarial testing to check whether the patch can actually prevent the attack and look for possible relevant vulnerability variants to avoid only fixing superficial problems but missing other exploitable paths.
Second, sufficient preparation time should be allowed for affected organizations. Different organizations have different protection tasks: software publishers may need to port patches to older versions, cloud hosting service providers need to verify temporary mitigation measures, and network security companies may need to prepare detection rules or Web Application Firewall (WAF) protection strategies in advance. OpenAI proposed that necessary technical information should be provided in stages based on the actual protection responsibilities of each participant, and the risk of leakage should be reduced through information sharing agreements and specialized coordination mechanisms.
Third, cooperation with government cybersecurity agencies is needed to ensure that critical infrastructure operators receive timely alerts and protection recommendations. In the PHP vulnerability incident, OpenAI and its partners contacted multiple U.S. government departments and cybersecurity agencies, including the White House Super Intelligence Task Force, the Office of the National Cyber Director, and the Cybersecurity and Infrastructure Security Agency (CISA), and coordinated with international partners.
Fourth, after the fix plan and public disclosure plan stabilize, the scope of participation should be expanded to allow more software publishers, cloud service providers, hosting service providers and enterprise security teams to prepare updates in advance. For organizations that are still using older versions of software and cannot directly install the latest patches, they also need to evaluate the feasibility of rolling back patches or other temporary protective measures.
Fifth, after the patch is officially released, clear repair guidelines should be provided to the public to help users confirm whether their systems are affected, which version should be installed, and how to verify whether the repair is effective. The entire response process does not end immediately when the patch is released. The security team also needs to continue to track the deployment and help organizations that have not yet completed the update to deal with actual problems.
OpenAI specifically pointed out that there are obvious dilemmas in sharing vulnerability information in advance. On the one hand, cloud service providers, network security vendors and critical infrastructure operators need sufficient technical details to effectively prepare protective measures; on the other hand, even limited vulnerability information may help attackers infer the specific location of the flaw. Therefore, relevant information should be provided in stages based on participants’ protective responsibilities, preparation time needs and ability to handle sensitive information.
The original disclosure schedule should also be reevaluated if actual exploitation of the vulnerability begins, technical details are accidentally leaked, or the public patch itself exposes the location of the vulnerability. OpenAI believes that coordination mechanisms must be able to adjust quickly as threats change, rather than mechanically following fixed deadlines.
In order to help more organizations take action, OpenAI stated that it will provide PHP version checking tools and plans to launch supporting Codex skills to assist system operators in identifying potentially risky PHP versions and determine applicable update plans based on official PHP and service provider guidelines. OpenAI also aggregates vulnerability disclosure information and protection guides through the "Patch the Planet" project to help administrators find authoritative patches, understand temporary mitigation measures, and check whether updates are actually deployed.
In terms of resource support, OpenAI promises to provide subsidized Daybreak service access worth US$1 billion through the "Daybreak for Frontline Defenders" program, focusing on helping organizations with limited security resources but responsible for critical service protection tasks. The company will also provide subscription support to open source software maintainers through Codex for OSS and directly sponsor projects such as the Rust Foundation to provide resources for maintenance work and technical improvements.
OpenAI pointed out that the maintenance teams of open source software projects are often limited in size. In addition to daily development work, they also need to handle security reports, determine the impact of vulnerabilities, verify patches, and be compatible with multiple software versions. These tasks are time-consuming, and artificial intelligence can assist in analyzing code, identifying duplicate reports, writing tests, and verifying fixes, thereby reducing the workload of maintainers.
In addition to discovering and fixing individual vulnerabilities, OpenAI also proposes that security flaws should be reduced starting from the software design stage. The company believes that AI can help engineers choose safer defaults, use security libraries correctly, and detect dangerous code patterns early in the development process.
Another important direction is migrating key software components to memory-safe languages. Many critical vulnerabilities result from memory management errors, such as accessing memory that has already been freed or buffer out-of-bounds occurrences. Using a language with memory safety guarantees can eliminate a large class of common defects at their source. Artificial intelligence can assist in code migration, but post-migration behavior, compatibility, and security still require testing and professional review.
OpenAI also emphasizes formal verification and stronger isolation mechanisms. Formal verification uses mathematical methods to prove that a program satisfies specific security properties under explicit assumptions, helping to improve the reliability of key components; sandbox technology can limit software that processes untrusted files, images, or media content to a controlled environment. Even if the program is compromised, it can reduce the opportunity for attackers to further control the entire system.
At the same time, the company acknowledges that expanding the use of artificial intelligence in cybersecurity will also require more sophisticated anti-abuse measures. OpenAI is further adjusting the security classifier for Daybreak in an effort to reduce the risk of the tool being used for malicious attacks. However, the company said that too strict restrictions can also hinder legitimate security research, so a balance must be struck between opening up defense capabilities and preventing malicious use.
OpenAI finally calls on software maintainers, researchers, network security service providers and enterprise operators to work together to improve this framework. The company hopes to focus on several issues: how much time should be allowed for defenders to prepare before a vulnerability becomes public; when critical vulnerabilities can be disclosed in advance; which organizations need to be alerted in advance; and how to reliably provide rollback patches and security alternatives when upgrading older versions of software cannot be done in a timely manner.
OpenAI also proposed a more controversial future scenario: Internet systems may gradually establish a continuous vulnerability scanning mechanism, notify website owners when known vulnerabilities are discovered, and even directly patch the system with appropriate authorization. However, this type of approach involves system ownership, management permissions, risks of misoperation and responsibility boundaries, and strict technical and governance guarantees still need to be established.
This PHP vulnerability incident shows that artificial intelligence is changing the way network security works. In the past, the discovery, analysis, repair, and large-scale deployment of serious vulnerabilities often required long-term coordination among multiple teams; today, advanced models can speed up vulnerability research, but truly protecting the Internet still depends on whether software maintainers, cloud service providers, enterprises, and government agencies can act quickly.
For OpenAI, "Patch the Planet" is not only an emergency response to PHP vulnerabilities, but also an exercise in exploring a coordinated vulnerability disclosure mechanism in the artificial intelligence era. As artificial intelligence’s ability to discover security flaws continues to increase, the key to cybersecurity competition in the future may no longer be just finding the vulnerability first, but who can verify the problem faster, fix the code, and get affected systems around the world protected in a timely manner.
Related articles:
PHP has exposed serious security vulnerabilities, and global website operators have urgently entered a patching state
Two serious vulnerabilities can lead to remote code execution on the server PHP official emergency security patch
Comments