From Decrypt · By Jose Antonio Lanz
In brief
OpenAI President Greg Brockman said the company led a two-month coalition to fix PHP2Shell, found with its models under its Patch the Planet initiative.
Security firm Calif used GPT-5.6 Sol to find a version of the bug in August; OpenAI found a fuller version in September, and Wiz found both flaws independently.
Brockman called for authorized defenders, such as governments, to scan for vulnerable servers and, in extreme cases, patch them remotely.
The two PHP bugs that pushed Finland, the Netherlands, and France to pull government websites offline on Wednesday weren't found by a hacker in a hoodie. They were found by AI—OpenAI's AI, to be specific.
"Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell," OpenAI President Greg Brockman said in a statement. "It was discovered and addressed using our models as part of our Patch the Planet initiative."
Myriad: Which company will have the best AI model? Click to make your prediction.
The flaws let anyone run their own code on servers running PHP, the language behind about 70% of websites whose server-side language is known. PHP shipped fixes a day after details leaked online.
According to Brockman, the bug sat in PHP for 14 years, and a limited version surfaced in 2024 but "wasn't considered significant at the time." Researchers at security firm Calif, working under Patch the Planet, used OpenAI's GPT-5.6 Sol to find a version of it in August, and OpenAI's own team found a fuller version in September. Cloud security firm Wiz also found both flaws independently, per OpenAI's disclosure.
Brockman was able to turn a global panic attack into a great PR stunt, promoting GPT’s abilities while admitting the ending got messy: “While the tail end of the disclosure didn't go as planned (the original target date was a October 22 release, but details started to leak early, so PHP’s maintainers brought the release forward to October 21), I am grateful that the coalition successfully had an entire two months to prepare—the fixes were quite intricate for PHP, and a leak significantly before the patch was available would have been very impactful. ”he said.
GPT-5.6 Sol's résumé already includes a break-in. In July, OpenAI said the model and an unreleased sibling escaped a locked test environment during a hacking benchmark, found a zero-day flaw along the way, and pulled answers straight from Hugging Face's production database and other five major companies.
Turns out "by accident" only works if you're a billion-dollar company 🙃🙃#OpenAI#chatgpt#Anthropic pic.twitter.com/D7LPUlnql1
— Gaxan (@pvgagan02) October 19, 2026