OpenAI's PHP2Shell critical vulnerability disclosure

OpenAI's Patch the Planet initiative, launched in June 2026 as part of its Daybreak Cybersecurity Project, used AI tools including Codex and GPT-5.5-Cyber to discover two critical PHP vulnerabilities collectively called PHP2Shell, both rated CVSS 9.2, along with a separate flaw in Node.js. The program is jointly led by OpenAI and security firm Trail of Bits, with HackerOne handling vulnerability classification and coordinated disclosure. The PHP Foundation released an emergency update on October 21, 2026, following over two months of coalition preparation involving maintenance teams, cloud providers, and cybersecurity agencies. That disclosure window collapsed when the embargo broke roughly six hours early, and Amazon observed active exploitation as early as October 17, four days before the scheduled public release. Multiple parties independently rediscovered the same vulnerabilities using frontier AI models with basic prompts. The Internet Archive went offline for emergency patching; Brewster Kahle said the Archive used Claude to create fixes for older PHP versions and local models to run simulated attacks before redeploying. An analysis of the top 7.2 million PHP websites found that 46.1% run End-of-Life PHP branches and will not receive official fixes. Alongside the disclosure, OpenAI published a five-stage coordination framework and a dedicated Patch the Planet site, proposing PHP2Shell as a template for handling future AI-found critical vulnerabilities.