[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
Latent Space Latent Space ● Covered by 16 sources
OpenAI says its Patch the Planet team helped find two critical PHP bugs. The flaws hit core PHP, so the fix had to be coordinated across the web.
Based on reporting by Latent Space, Latent Space — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
OpenAI is claiming a rare win for its defensive AI work: its Patch the Planet program helped uncover two serious bugs in PHP core, while Wiz says it found the same flaws too. The vulnerabilities were disclosed as PHP2Shell, with CVE-2026-109618 and CVE-2026-109619 attached to them. If you run a lot of the internet on PHP, that gets attention fast.
The details matter here. The bugs were not buried in some stray WordPress plugin or a bad login flow. They sit in PHP’s handling of out-of-memory conditions and fatal errors, which is a much uglier place to have a hole. The researchers say they were able to demonstrate remote code execution without authentication on WordPress, Drupal, and Joomla, plus remote memory disclosure in PHP apps.
OpenAI says the work took about two months of coordination before public disclosure, and that fixing it required a major PHP-engine change. The patching effort involved maintainers, researchers, security providers, and governments. A participating researcher also says they worked with the PHP Foundation to support and harden the patch. That is not a quick bug-fix sprint; it is a small emergency response.
Cloudflare moved early with WAF mitigations before the patch release, covering known exploit paths and making those rules available to all customers, including the free tier. The NSA also urged operators to prepare for an immediate update and, if they could not mitigate in time, to take systems offline. OpenAI later said upgrades were available, but the supplied material does not give a clean fixed-version list. What it does show is how fast a core-runtime flaw can force the whole ecosystem into triage mode.
My take — AI-written commentary, not fact-checked reporting
This is the part where the industry pretends it loves coordination, then acts shocked when coordination is exactly what security takes. The bigger story is not that AI found a nasty PHP bug; it is that the open web still depends on a runtime that needs emergency choreography to survive its own flaws. That’s not a headline, that’s maintenance with better branding.
Read more about this at: Latent Space