OpenAI says its AI models helped uncover the critical PHP security flaws that have websites across the internet scrambling.
In a blog post on Wednesday, the company said it had spent the past two months leading a coalition of PHP maintainers, security researchers, and security companies to deal with the vulnerabilities, now nicknamed "PHP2SHELL." In its own Wednesday blog post, the PHP foundation thanked OpenAI, among other industry partners and cybersecurity researchers.
The newly exposed flaws could allow attackers to take over servers running PHP, the programming language behind a large share of the web. OpenAI called the bugs one of the most impactful security problems in recent memory.
According to OpenAI, security firm Calif found one of the critical flaws using the company’s GPT-5.6 Sol model as part of Patch the Planet, an OpenAI security program. Security company Wiz also discovered and reported both vulnerabilities on its own, OpenAI said. PHP’s maintainers led the work on the fixes. OpenAI, Wiz, Cloudflare, and other partners contributed research and helped prepare protections before the flaws went public.
OpenAI President Greg Brockman added more detail in a post on X. He said PHP was the first programming language he learned, which gave him a personal connection to the work.
This Tweet is currently unavailable. It might be loading or has been removed.
According to Brockman, the bug had existed in PHP for 14 years. A smaller version of it was found in 2024, but wasn’t treated as serious at the time. Calif found a version of the bug in August, and OpenAI’s own team independently found a more complete version in September.
The coalition planned to disclose the flaws on Oct. 22, Brockman said, but details leaked early, and PHP’s maintainers released the fixes a day sooner. He said the two months of preparation still mattered, because the fixes were complicated and an earlier leak could have caused far more damage.
OpenAI said it also worked with U.S. government agencies on the response, including the White House’s Super Intelligence Force, the Office of the National Cyber Director, and the Cybersecurity and Infrastructure Security Agency.
This Tweet is currently unavailable. It might be loading or has been removed.
OpenAI says PHP won’t be the last case of this kind. The company said it has already found several other serious vulnerabilities and expects similar discoveries to rise sharply in the coming months. Brockman pointed to a separate remote code execution flaw that Node.js, another widely used web technology, disclosed on Wednesday.
This year, new AI models like GPT-5.6-Sol and Claude Mythos have led to a rapid rise in bug discoveries, pushing some zero-day bug initiatives to shut down entirely, as Mashable reported previously.
Want to learn more about getting the best out of your tech? Sign up for Mashable's Top Stories and Deals newsletters or get Mashable push alerts today.
Brockman wrote that the current way of handling bugs like these is "slow and manual," and won’t scale as AI gets better at finding them. OpenAI is now asking the security community for feedback on a new process for coordinating disclosures. One idea that floats is having governments or other authorized defenders constantly scan the internet for vulnerable systems. They would warn site owners when they find one and, in extreme cases, patch the systems themselves.
OpenAI also acknowledges the risk in its pitch. The same AI capabilities that helped find these bugs could help attackers build exploits faster. To put more of those tools in defenders’ hands, the company says it has committed $1 billion toward subsidized access to its security tools for organizations that protect essential services. It is also releasing a tool that helps site operators check whether they’re running a vulnerable version of PHP.
Meanwhile, the internet is having a week
The patch scramble has been very visible. Wikipedia went down Wednesday morning, and the Wikimedia Foundation confirmed to Mashable that the outage was tied to the PHP vulnerabilities. The foundation said it had taken other systems offline as a precaution until they could be safely patched.
Other popular sites have also gone down or posted maintenance notices. According to Downdetector, sites having trouble in the midst of the PHP issues include Asana, GOG, Duolingo, Capital One, Bitbucket, Moodle, Quest Diagnostics, Final Fantasy XIV, War Thunder, and the Internet Archive. Most haven’t said whether their problems are connected to PHP, but, again, the programming language runs much of the internet.
Even outside of the response from the cybersecurity arm of the U.S. government, other world leaders are getting involved too. Japan’s prime minister made an unusual public appeal on X, urging anyone who runs a website to act that night, according to a translation of the Japanese-language post.
This Tweet is currently unavailable. It might be loading or has been removed.
The PM asked site owners to check whether their public websites use PHP and to install the fix as soon as it was released at 11 p.m. Japan time on Oct. 21, which matches PHP’s 10 a.m. ET release.
For most people, the impact should be limited to some sites being temporarily unavailable. Regular users don’t need to install anything, since the fix is up to the companies running the sites.
Disclosure: Ziff Davis, Mashable’s parent company, in April 2025 filed a lawsuit against OpenAI, alleging it infringed Ziff Davis copyrights in training and operating its AI systems.
