OpenAI says a model helped identify a critical PHP flaw, prompting a coordinated patching effort involving maintainers, security firms and government agencies.
OpenAI says a model used in its Patch the Planet initiative identified a critical vulnerability in PHP, the open-source programming language that powers websites and web applications. The company says security firm Wiz independently found and reported two vulnerabilities, while PHP maintainers led the fixes and release. OpenAI, Wiz, Cloudflare and other partners contributed research, technical assistance and coordination before disclosure.
The work highlights a defensive use of AI with implications beyond a single software project: flaws in widely deployed infrastructure can affect organizations that may not have dedicated security teams. OpenAI says it believes frontier AI identified the vulnerabilities before attackers did, giving maintainers and service providers time to prepare patches and protections. That is the company’s assessment; its announcement does not establish that the flaws were actively exploited or provide detailed technical descriptions.
OpenAI is urging organizations that use PHP to apply the relevant updates and points operators to a version-checking tool, PHP’s upgrade guidance and provider-specific advice. It says it coordinated with U.S. agencies, including CISA and the Office of the National Cyber Director, as well as international partners, to help guidance reach organizations responsible for critical systems.
The disclosure also outlines a proposed process for future vulnerabilities: validate and fix the issue with maintainers, share advance information with organizations that need time to prepare, coordinate with government and infrastructure providers, and publish remediation guidance once defenses are ready. OpenAI says it has committed $1 billion in subsidized access to its Daybreak security offering for frontline defenders. For security teams, the immediate takeaway is operational: use authoritative PHP guidance to assess exposure, prioritize patching and verify that fixes are deployed. The broader question is whether coordinated disclosure can keep pace as AI tools make vulnerability discovery more accessible to both defenders and attackers.