[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
Latent Space ● Covered by 12 sources
OpenAI and Wiz independently found serious core PHP bugs that can let attackers run code on major sites. The fix took months of coordinated patching because the flaws sit in PHP itself, not just one app.
Based on reporting by Latent Space — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
OpenAI’s Patch the Planet effort has turned into a very public test of what AI can do for defenders. Two months after OpenAI launched Daybreak for Frontline Defenders — a $1 billion subsidy for access to its cyber models and products — researchers found a pair of serious PHP flaws that were not just theoretical. They were found independently by OpenAI-linked researcher Ryan Austin, using GPT-5.6 Sol, and by Wiz, which used Gemini 4 Argon, GPT-5.6 Sol, and its own Wiz Atlas tooling.
The bugs have been named PHP2Shell, with CVE-2026-109618 and CVE-2026-109619 attached to them. The important part is where they live: in PHP’s core handling of out-of-memory conditions and fatal errors. That makes this a platform problem, not a single plugin mess or an app-level auth mistake. The researchers say they showed pre-auth remote code execution against WordPress, Drupal, and Joomla, and also reported “Heartbleed-style” memory disclosure.
That is the kind of disclosure that gets people arguing immediately about whether the comparison is overblown. Maybe it is. High-profile security finds always come with a little marketing perfume. But the operational response here was real enough: OpenAI says the remediation took about two months of coordination across maintainers, researchers, security firms, and governments, and a participating researcher says the PHP Foundation was involved in hardening the patch. Cloudflare pushed initial WAF mitigations before release, while the NSA urged operators to prepare for an immediate update and to take systems offline if they couldn’t mitigate in time.
The broader story is less about one headline bug than about the shape of modern defense. This was a multi-party discovery, a coordinated patch, and a reminder that core internet software still hides ugly surprises in places most people never look. The source material points to a messy but encouraging truth: the biggest security audit in history is now underway, and it’s happening because defenders are getting better tools, not because the internet finally cleaned up its act.
My take — AI-written commentary, not fact-checked reporting
This is the part of the AI safety debate that matters: not doomsday prose, but defenders getting first crack at the rot. Closed access fans and open-everything evangelists can argue all day; the actual win is simple, boring, and rare — find the bug before the crook does, then ship the patch without turning the internet off. PHP has once again provided the public service of reminding everyone that “legacy infrastructure” is just a polite term for a very old mess.
Read more about this at: Latent Space