OpenAI AI finds critical PHP flaws scored 9.2, two-month fix precedes disclosure

OpenAI's GPT-5.6 Sol identified two critical PHP vulnerabilities scored 9.2 out of 10 on severity; Wiz independently confirmed both. The flaws could allow attackers to execute malicious code on servers without any login credentials. PHP powers an estimated 70% of websites, including platforms like WordPress. Because remediation required a major change to the PHP engine, a coalition that included Cloudflare, Wiz, and government agencies worked with PHP maintainers for two months before public disclosure. The PHP development team released emergency security updates at the end of that coordinated process. OpenAI said it considers this 'one of the most impactful vulnerabilities in recent memory' given PHP's widespread use, and described the outcome as an example of its 'Defender's Window': 'to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.' The PHP case is one disclosed outcome of OpenAI's Patch the Planet program, which launched in June 2026 as part of a broader cybersecurity effort called Daybreak. Patch the Planet covers the full defensive security loop including discovery, validation, severity review, disclosure, patch development, testing, and deployment. OpenAI built the program jointly with Trail of Bits, which has dedicated security engineers working full time with Codex and GPT-5.5-Cyber across 19 open-source projects. Partners also include HackerOne and Calif for vulnerability triage and coordinated disclosure. Initial participating open-source projects include cURL, NATS Server, pyca/cryptography, Sigstore, aiohttp, Go, freenginx, and Python. The team has already identified hundreds of security issues and merged dozens of patches, with more undergoing coordinated disclosure. OpenAI released GPT-5.5-Cyber through limited access for trusted defenders as part of the Daybreak expansion.