# OpenAI — Patch the Planet: global response coordination as agents uncover critical vulnerabilities

- Company: OpenAI (openai.com)
- Announced: 2026-10-21T07:00:00+00:00
- Category: safety-policy-update
- Coverage: 7 outlets
- Announcement: no
- Group: covered
- Source: https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities
- Record: https://forck.live/items/25987-patch-the-planet-global-response-coordination-as-agents-uncover-critical
- Subject: GPT / ChatGPT / API
- Models affected: GPT-5.6 Sol

OpenAI says it led a coalition of maintainers, researchers and security providers to fix critical vulnerabilities in PHP, the open-source language used to run websites and web applications. Calif found a critical flaw using GPT-5.6 Sol as part of OpenAI's Patch the Planet initiative, and Wiz independently discovered and reported both vulnerabilities, while PHP's maintainers led the fixes and release. OpenAI says the priority for organizations using PHP is applying the fixes, and it is sharing a PHP version checker and will launch an accompanying Codex skill to help operators identify potentially vulnerable versions. The company calls the flaws among the most impactful security issues in recent memory and says that, to its knowledge, frontier AI found them before attackers did, opening a Defender's Window for maintainers and providers. OpenAI has committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, aimed at organizations with limited security resources protecting essential services. It is also proposing a five-stage framework for responding to critical vulnerabilities in widely used software and asking the security community to help improve it.

## Evidence

Verbatim from https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities:

> To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender’s Window for maintainers and security providers to prepare fixes and protections ahead of disclosure.

## Around this story

Outlets this record can name and link:

- The Information — AI Finds Flaw in Popular Web Hosting Software, Sparking Global Race to Patch: https://theinformation.com/briefings/ai-finds-flaw-popular-web-hosting-software-sparking-global-race-patch
- Forbes: https://forbes.com/sites/thomasbrewster/2026/10/21/openai-ai-found-one-of-the-biggest-web-weaknesses-ever
- The Hacker News — PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't: https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html
- The Record — Hundreds of websites taken offline as concern grows over two PHP vulnerabilities: https://therecord.media/php-script-vulnerabilities-warnings
- iTnews: https://itnews.com.au/news/critical-flaws-strike-php-as-disclosure-embargo-is-broken-629794
- Yle News — Finland temporarily shuts down government websites as a precaution for critical vulnerabilities: https://yle.fi/a/74-20252600
- Wikimedia — Impact of PHP vulnerabilities on Wikimedia tools and services: https://diff.wikimedia.org/2026/10/21/impact-of-php-vulnerabilities-on-wikimedia-tools-and-services

---

Record: https://forck.live/items/25987-patch-the-planet-global-response-coordination-as-agents-uncover-critical
Catalogue: https://forck.live/llms.txt
Current issue: https://forck.live/feed.md