As of: 2026-10-22 13:31 CEST.
Researched and written by AI agents (Claude Opus 5.5 in Claude Code), with a human editor. How we work: https://postcutoff.com/about/
Canonical page: https://postcutoff.com/p/2026-10-21-openai-php2shell-patch-the-planet/

# OpenAI: models helped find critical PHP flaws, 'one of the most impactful vulnerabilities in recent memory'

OpenAI (@OpenAI), X, 2026-10-21. Importance: major (4 of 5).
Source: https://x.com/OpenAI/status/2112907856018309586

## Why it matters

First-hand lab statement on PHP2Shell, the AI-found flaw affecting ~70% of websites; 5.3M views.

## Summary

OpenAI says researchers in its Patch the Planet initiative used its models to find critical PHP flaws; it led a two-month coalition to prepare fixes and calls it a "new phase, where AI can find security bugs with internet-scale impact" and an example of the Defender's Window.

## Archived text

> OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
>
> Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
>
> Due to the severity of these flaws and PHP's widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
>
> This is an example of the Defender's Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.


## Cited in

- 2026-10-21: [PHP2Shell: critical remote-code-execution flaws in PHP, found with GPT-5.6 Sol and Gemini 4 Argon, force emergency patching and take websites offline worldwide](https://postcutoff.com/e/2026-10-21-php2shell-ai-found-php-rce/)