OpenAI reveals it led a two-month coalition to fix "php2shell" — the PHP bugs that took EU government sites offline
Over two months, OpenAI led a coalition under Patch the Planet to fix php2shell, two critical PHP bugs with unauthenticated remote code execution. Calif researchers found a version in August with GPT-5.6 Sol, OpenAI's team found more in September, Wiz independently found both. Finland, the Netherlan
What happened
OpenAI president Greg Brockman said the company led a two-month coalition to mitigate php2shell, "one of the most severe bugs in open source software found in recent memory," discovered and addressed using OpenAI's models as part of its Patch the Planet initiative. The two PHP flaws (CVE-2026-109618 and CVE-2026-109619, 9.2 severity) allow unauthenticated remote code execution on PHP servers — PHP powers roughly 70 percent of websites with a known server-side language. The bug sat in PHP for 14 years. Researchers at security firm Calif used GPT-5.6 Sol to find a version of it in August; OpenAI's own team found a fuller version in September; Wiz found both flaws independently. Details leaked early, so PHP's maintainers moved the patch release up a day from October 22 to October 21.
Why it matters
The disclosure turned into a real-world internet-scale response: Finland, the Netherlands, and France took government websites offline rather than risk exposure, and the NSA warned organizations that the flaws offer a direct path to a server's file system and database. Brockman called for authorized defenders such as governments to scan vulnerable servers and, in extreme cases, patch them remotely. This is the second time in three months AI models found a critical one-request web-server takeover — in July, wp2shell gave a similar unauthenticated takeover of default WordPress installs, also found with GPT-5.6 Sol.
Verified Oct 22, 2026
Sources
Get updates like this every morning
- ② Card on Stripe
- ③ 7 days free
Then $2/month · cancel anytime in one click