# @OpenAI: OpenAI models helped find critical PHP security flaws before disclosure

Source: https://x.com/OpenAI/status/2112907856018309586
Kiwi News: https://news.kiwistand.com/stories/OpenAI-OpenAI-models-helped-find-critical-PHP-security-flaws-before-disclosure?index=0x6ad8de1834b729154fb6e2c2941509ce80170a1edeab2baca4c33725f550ab7e75f75995
Submitted by tim on 2026-10-21 UTC, 1 upvote, 0 comments

## Summary

OpenAI says its models helped researchers working under its Patch the Planet initiative discover critical security flaws in PHP, an open-source programming language it says is used to run an estimated 70% of websites. Over the past two months, OpenAI led a coalition of maintainers, researchers, and security providers to prepare fixes and protections before disclosure, a timeline the company says was needed because the fix was intricate and required a major change to the PHP engine. Every PHP site can now upgrade to a secure version, alongside mitigations from various security vendors. OpenAI describes the bug as one of the most impactful vulnerabilities in recent memory and says that, to its knowledge, frontier AI found it before attackers, giving defenders time to prepare.

## Article

OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.

Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.

Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. 

This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/