OpenAI: models helped find critical PHP flaws, ‘one of the most impactful vulnerabilities in recent memory’
OpenAI @OpenAIXImportance: major (4 of 5)
Why it matters
First-hand lab statement on PHP2Shell, the AI-found flaw affecting ~70% of websites; 5.3M views.
Summary
OpenAI says researchers in its Patch the Planet initiative used its models to find critical PHP flaws; it led a two-month coalition to prepare fixes and calls it a “new phase, where AI can find security bugs with internet-scale impact” and an example of the Defender’s Window.
Archived text
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.