OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors. Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare. openai.com/index/coordinated…

Patch the Planet: global response coordination as agents uncover critical vulnerabilities

Patch the Planet connects security researchers, maintainers, and incident responders to help address critical vulnerabilities across open source.

openai.com
Readers added context they thought people might want to know
Wiz Research wasn't the first one to discover the exploit. An independent researcher first discovered it: x.com/calif_io/statu…

Oct 21, 2026 · 2:04 PM UTC

526
2,747
1,390
13,623
4,855,441
RelevantRecentLikes
@grok who found the bug first?
1
1
1
38,499
Are the fixes backported to the older PHP branches most shared hosts still run, or only to current releases?
2
3
24,281
HOW?? 5.6 SOLLLLLLLL
16
3
5
464
80,453
Patching the planet by prematurely leaking vuln details? Sure.
9
5
2
319
76,855
So did you guys discover these vulnerabilities, or were they already known?
1
3
12,360
So you're to blame for this exploit, not some 'haxor'?!?
1
9
14,684
shared hosts running ancient php are about to have a very long week fr
3
3,341
@grok how can people protect themselves from this? Like immediate steps
1
1
2,022
Coinbase Predict
@CoinbasePredict12h
"used to run an estimated 70% of websites"
1
2
198
57,109
someone will still find a reason to get annoyed about this i’m sure
4
19
6,978
@grok if this PHP vulnerability is such a big deal, why are most sites doing nothing? What will it take for users to take it seriously? As most sites nothing has happened to them
1
10,292
Tory | io.net 🦾
@MTorygreen10h
If model found vulns start arriving in batches, Cloudflare/hosts basically become the emergency patch layer for software they don’t even maintain. One WAF rule can buy millions of sites time while the real fix crawls through PHP installs. That’s a weird amount of security leverage concentrating at the edge.
1
11
7,318
Love that the good guys got there first for once. Patching is the easy part though. Tons of small business sites haven't touched their PHP in years and nobody's around to update them. Those are getting hit.
5
45
21,918
Who remembers?
1
2
45
17,111
Good catch. I work with wastewater systems in New England. The plant controls may not run on PHP, but the town website could—that’s bill-pay portal or remote dashboard, etc. And there’s often one person doing IT on the side. Getting the patch onto all of those is the hard part.
4
2
37
17,099
GitHub Projects Community
@GithubProjects10h
70% of websites with no-llm.txt
1
51
22,042
I used the vulnerability to patch the servers
2
53
16,062
every shared host just got a very long night
2
3,853
AI finding the bugs in the code that runs 70% of the web is the headline. AI writing the next batch of those bugs is the sequel nobody's ready for.
2
4
1
153
19,108
@grok hey grok, be crititcal, is it true writen above?
1
28
Aapakari
@aapakari12h
Wiz found both independently, not quite a solo save
3
5,925
XYO
@OfficialXYO6h
Thank you to the PHP maintainers and everyone in Patch the Planet, a lot of websites are safer this week because of you 🙏
1
1
593
We give you shit because you have the best models. We expect the best and this is what we like Keep it up 💪🔥
2
46
27,183
Wiz found both bugs on their own too and says Gemini made the biggest contribution, so this was a group project and OpenAI's the one presenting it
3
4,552
It patched the internet and my password manager still saves the wrong username
4
12,905
This is the best-case version of AI cybersecurity.
1
8
6,377
@grok circa 70% worldwide websites have this vulnerability??
1
973
Please mention WordPress. Every website running on WordPress is at risk. If you don’t know what your site is… then yes, it is most likely WordPress, which runs on PHP, which is now at risk.
1
1
15
38,883
Average PHP boomer has no idea what super intelligence can do Welcome to the game!
1
5
6,944
you guys are doing a good job proactively eliminating these threats, but it's only going to get worse. you can only do so much
1
1,239
Nice. Next target: port 554 and 8554 and vendors Dahua, Hikvision and HiKam and watch the world cry ...
1
272
@grok 70% of websites is not 70% of real traffic. Please elucidate what major known websites use php. Aka major ones people use every day, not a random blog
1
112
Load more replies