OpenAI's AI Finds a Decade-Old PHP Flaw, Then Coordinates the Fix

A pair of severe security flaws in PHP, the scripting language that powers a huge share of the world’s websites, has forced a rare global scramble this week. The bugs were discovered with help from OpenAI’s AI tools and then fixed in a coordinated rush involving software maintainers, security firms, cloud providers and national cybersecurity agencies, according to OpenAI and security researchers.

The two vulnerabilities, grouped under the nickname PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, both scored 9.2 out of 10 on the CVSS v4.0 severity scale. In the worst case, an attacker could run arbitrary code on a vulnerable server, which is about as serious as web security gets. The flaws are reported to have lurked in the codebase for more than a decade.

The discovery came from OpenAI’s Patch the Planet program, an initiative that pairs AI models with security researchers to hunt for weaknesses in widely used open-source software. Security company Calif and cloud security firm Wiz are said to have independently surfaced the PHP issues with AI assistance in August. What followed was roughly two months of quiet work to prepare fixes before anyone could weaponize the bugs.

That plan was disrupted when details leaked on October 20, apparently before the coordinated release date. The leak sent PHP operations teams into a long night, as administrators rushed to assess exposure and apply mitigations. The PHP Foundation pushed out official patches on October 21, and OpenAI published its account of the whole effort the same day.

The story matters far beyond developer forums. PHP underpins content management systems, forums and storefronts across the internet, and estimates circulating in Chinese tech media put its reach at roughly seventy percent of websites. A remotely exploitable flaw in that layer is a systemic risk, not a niche one, which is why cloud providers and government security bodies joined the response.

For OpenAI, Patch the Planet is also a statement about how AI might change vulnerability research. Finding bugs at scale has traditionally been slow, manual work. AI models can scan enormous codebases quickly, but the harder part is the human machinery that follows: verifying findings, writing patches, warning vendors and keeping everything secret until users can update. The PHP episode tested that machinery under leak pressure.

The episode also highlights a growing tension. AI-assisted discovery means more flaws will surface faster, and not every project has the maintainers or resources to respond at speed. Coordinated disclosure norms, once a quiet corner of the industry, are becoming a global logistics exercise involving companies and agencies that rarely talk to each other.

For ordinary users and businesses, the practical advice is unchanged: update PHP installations and dependent software promptly, and watch for vendor advisories. For the industry, the lesson may be that AI is now part of the security supply chain, and the race is no longer just about finding bugs but about fixing them before the internet finds out.