OpenAI details php2shell PHP bug and the limits of manual disclosure

Greg Brockman of OpenAI writes that the company spent two months leading a coalition to contain php2shell, which he calls one of the most severe open-source bugs found in recent memory. He says it was discovered and addressed using OpenAI's models as part of the company's Patch the Planet initiative, and that it lets an attacker run code on nearly all deployed PHP applications.

The flaw is in PHP itself, not in any one website's code. According to the technical write-up from Wiz Research, which worked on the discovery, the bugs come from how PHP handles fatal errors in the middle of a request, especially running out of memory. The crash can leave corrupted internal state behind. A later request served by the same worker process can reuse that stale state, letting an attacker read memory that may hold other users' passwords, tokens or API keys, or corrupt memory to run their own code. Wiz says the issues fall under two CVEs with severity up to 9.2 out of 10, that every PHP version back to 5.4 is affected by at least one of them, and that it demonstrated unauthenticated code execution against WordPress, Drupal and Joomla. Patched PHP releases came out on October 21, and Wiz calls the update the only complete fix.

The two accounts of who found it put the emphasis in different places. Brockman says the bug had been in PHP for 14 years and a limited version surfaced in 2024 without being judged significant. In his telling, researchers at the security firm Calif, working within Patch the Planet, used GPT-5.6 Sol to find a version in August, and OpenAI's team independently found a more complete version in September. Wiz's timeline says its own researchers found the first vulnerability on August 19 using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, reported it to PHP on August 24, and credits PHP, Calif and OpenAI for discovery, coordination and patch verification. Brockman adds that the release had been planned for October 22 but was moved up a day after details began to leak.

His larger point is that this process was too slow and manual for what is coming. OpenAI is working on several other serious bugs it has found, he says, including a remote code execution flaw Node.js announced the same day, with less attention because of limited bandwidth, and he expects many more in the coming months. He floats new approaches, potentially including authorized defenders such as governments scanning the internet for vulnerable hosts and notifying them or, in extreme cases, patching them remotely. He argues defenders need access to stronger models than attackers and that keeping the most capable cyber models should be a national priority. He points to OpenAI's $1 billion in credits for frontline defenders, committed on September 3, and its Daybreak program for trusted defenders.

Not everyone accepts the alarm. In a post the same day, Elias Taylor argues there is no easy exploit for this vulnerability. He says the many proof-of-concept exploits on GitHub fail against a plain PHP install, and that most of them depend on local file inclusion, an existing hole that lets an attacker make the server run a file of their choosing. He was writing about ten hours after disclosure, about the exploits circulating publicly. Wiz's own account points both ways. It says attackers can exploit the flaws remotely, in some cases fairly easily, but also that building its exploit required chaining several flaws and adapting to each target's memory layout, work it says frontier models made practical. Neither post settles how easily attackers outside Wiz can reproduce that.