Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell, found as part of our Patch the Planet initiative. https://t.co/rBsz7lrlwo
Frontier models are now finding internet-scale bugs such as a 14-year-old PHP RCE, and manual disclosure is already a bottleneck. Engineers should expect faster patch cycles and more model-driven defensive tooling and access programs.
Key takeaways · AI-distilled
Per the OpenAI post, php2shell lets an attacker execute code on nearly all deployed PHP applications. The bug existed for 14 years, and a limited version found in 2024 was not considered significant at the time.
Calif researchers in OpenAI's Patch the Planet initiative found a version with GPT-5.6 Sol in August, and OpenAI's team found a more complete version in September, giving a coalition including PHP, Wiz and Cloudflare two months to prepare intricate fixes.
Disclosure did not go fully to plan: details leaked early, so PHP maintainers moved the release from October 22 to October 21. Other fixes, including a Node.js RCE announced the same day, got less attentionThe mechanism that lets a model weigh which earlier words matter for the word it's currently processing — the core operation of a transformer.Full definition → because of bandwidth limits.
The author argues bug-by-bug manual disclosure will not scale as models find more vulnerabilities, and raises authorized defenders such as governments scanning for vulnerable hosts and, in extreme cases, patching them remotely.
OpenAI says it committed $1B in model credits to frontline defenders on September 3 and is scaling its Daybreak program for trusted defenders while tightening safeguards against abuse.
Terms in this piece · Glossary
attention — The mechanism that lets a model weigh which earlier words matter for the word it's currently processing — the core operation of a transformer.
