OpenAI Says Frontier AI Found Critical PHP Flaws Before Attackers Did
OpenAI published a security post on October 21, 2026 describing a coordinated disclosure of critical vulnerabilities in PHP, the open-source language behind much of the web. Everything below comes from that first-party post.
Transcript
OpenAI says frontier AI found critical PHP flaws before attackers did. Fixes are available now.
For two months OpenAI led a coalition of maintainers and security providers. PHP's maintainers led the fixes, while Wiz and Cloudflare helped prepare protections.
OpenAI says the priority now is applying the fixes. It is sharing a PHP version checker, with a Codex skill coming.
OpenAI committed one billion dollars in subsidized access for defenders with limited resources. It expects similar findings to increase sharply.
This is OpenAI's own account on its own website. The framework is only proposed, and the post names no severity scores or outside reviewer.
Inboxsmith builds AI receptionists for small business. Please like and subscribe for more news.
Sources
Every claim in this video comes from the top ranking coverage of this topic. The claims and where each one came from:
- Over the past two months, we led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications.(OpenAI (openai.com), first party post titled "Patch the Planet: global response coordination as agents uncover critical vulnerabilities", October 21, 2026)
- PHP's maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure.(OpenAI (openai.com), first party post titled "Patch the Planet: global response coordination as agents uncover critical vulnerabilities", October 21, 2026)
- For organizations using PHP, the priority now is applying the fixes. We're sharing a PHP version checker and we will be launching an accompanying Codex skill to help operators identify potentially vulnerable PHP versions.(OpenAI (openai.com), first party post titled "Patch the Planet: global response coordination as agents uncover critical vulnerabilities", October 21, 2026)
- To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender's Window for maintainers and security providers to prepare fixes and protections ahead of disclosure.(OpenAI (openai.com), first party post titled "Patch the Planet: global response coordination as agents uncover critical vulnerabilities", October 21, 2026)
- To help more defenders use these capabilities, we've committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, focused on organizations with limited security resources protecting essential services. As significant as they are, these bugs are among several significant vulnerabilities we've already found and are working to fix, and we expect similar findings to increase sharply in the coming months.(OpenAI (openai.com), first party post titled "Patch the Planet: global response coordination as agents uncover critical vulnerabilities", October 21, 2026)
- Drawing on our experience thus far, we're sharing a proposed approach, appropriate for the AI era, to responding to critical vulnerabilities in widely used software, and we're asking the security community to help improve this framework. We also welcome recommendations for independent security experts who can review the approach, challenge its assumptions, and identify gaps. Every claim is OpenAI's own account published on its own website: the post contains no CVE identifiers, no severity scores, no patched version numbers, and no named independent reviewer.(OpenAI (openai.com), first party post titled "Patch the Planet: global response coordination as agents uncover critical vulnerabilities", October 21, 2026)