ResearchOpenAI

OpenAI helps fix critical PHP security flaws

Original title: Patch the Planet: global response coordination as agents uncover critical vulnerabilities

Plain language

What it is: OpenAI announced the Patch the Planet initiative, which helped identify and fix critical security flaws in the PHP programming language before attackers could exploit them. They also proposed a new global framework to coordinate how security vulnerabilities are handled and fixed in the AI era.
How it works: AI models are used to scan and find security bugs in software. OpenAI then works with software creators, security companies, and government agencies to create fixes, test them, and help organizations update their systems safely.
Where it is available: This applies to the PHP programming language and open-source software. OpenAI is offering a PHP version checker tool as a Codex skill, and providing subsidized access to their Daybreak tool for eligible frontline defenders.
Example: A security researcher used the GPT-5.6 Sol model to find a critical security flaw in PHP, allowing creators to fix it before it was publicly disclosed.

What it is: OpenAI disclosed its role in coordinating the patch of critical PHP vulnerabilities discovered via GPT-5.6 Sol, and proposed a five-stage coordinated vulnerability disclosure framework designed for AI-accelerated discovery. They also committed $1 billion in subsidized Daybreak access for frontline defenders.
How it works: The proposed framework involves upstream validation and adversarial testing of patches using frontier models. It also gives distributors and hosting providers advance time to prepare mitigations like WAF rules, coordinates with government agencies, and publishes deployment guidance.
Where it is available: The initiative applies to open-source software, specifically PHP in this case. The PHP version checker is available as a Codex skill, and open-source projects can apply to Patch the Planet for hands-on support.
Example: Calif used GPT-5.6 Sol to identify a critical vulnerability in PHP, which was then patched in coordination with PHP maintainers, Wiz, Cloudflare, and government agencies like CISA.

The headline and explanation on this page are based on OpenAI's post. The full details are in the original.

Patch the Planet: global response coordination as agents uncover critical vulnerabilities