OpenAI reviews PHP vulnerability incident: secretly coordinated for two months, but leaked early by forum

Beating AI News Flash: OpenAI published a post reviewing a two-month secret remediation effort behind the PHP vulnerability incident. Security firm Calif, using GPT-5.6 Sol, discovered a critical vulnerability in PHP. Another security firm, Wiz, also used models including Gemini 4 Argon and GPT-5.6 Sol to independently discover and report two vulnerabilities. These issues lay hidden in PHP's underlying code for over a decade, and attackers could potentially take control of servers running affected websites without logging in, and even steal sensitive information such as passwords.

PHP powers a large number of websites such as WordPress and Drupal. Over the past two months, OpenAI led coordination among PHP maintainers, Wiz, Cloudflare, and other organizations to prepare patches and defenses under confidentiality, and also communicated with the White House and U.S. cybersecurity agencies. The actual fixes were led by PHP maintainers, involving nearly 200 files and more than 10,000 lines of code.

The vulnerabilities were originally scheduled to be disclosed on October 22, but unexpectedly on the 20th someone leaked the vulnerability numbers, severity, and disclosure timeline early on the Hacker News forum. The PHP team was forced to issue an alert ahead of schedule, moving the patch release date up by one day. Cloudflare subsequently confirmed it had observed early attack attempts, and some government websites in countries including the Netherlands and Finland proactively went offline to avoid risk. It was not until October 21 that PHP officially released the fixed version, and each website still needs to upgrade on its own.

OpenAI calls this period of early discovery and coordinated remediation the "defender's window." Wiz's research shows that with frontier AI models, complex vulnerability exploitation methods that previously required top security teams months to develop may now be completed by a single researcher within a week. AI makes it easier for defenders to find security issues that have been hidden for years, while also greatly lowering the technical barrier for attackers to exploit these vulnerabilities.