OpenAI discovers PHP vulnerability causing government website downtime

OpenAI President Greg Brockman said the company led a group of partners for two months to fix the PHP2Shell security flaw. Security company Calif found one version of the flaw in August using GPT-5.6 Sol. OpenAI found a more complete version in September, and cloud security company Wiz independently found both flaws.

Brockman also urged authorized security teams, such as government agencies, to scan for vulnerable servers and, in extreme cases, fix them remotely.

Two PHP security flaws caused government websites in Finland, the Netherlands, and France to go down on Wednesday. The flaws were discovered not by traditional hackers, but by artificial intelligence, specifically AI from OpenAI.

“For the past two months, we have been leading a group to fix one of the most serious security flaws recently found in open-source software, php2shell,” said OpenAI President Greg Brockman in a statement. “This flaw was found and fixed as part of our ‘Patch the Planet’ initiative, with help from our models.”

These security flaws allowed anyone to run their own code on servers using PHP. PHP is a programming language used by about 70% of known websites that run code on their servers. PHP released a fix one day after the details of the flaws became public.

Brockman said the flaw had existed in PHP for 14 years. A less serious version appeared in 2024, but “was not considered significant at the time.” Researchers at security company Calif found one version of the flaw in August while working on the “Patch the Planet” initiative and using OpenAI’s GPT-5.6 Sol model. OpenAI’s own team found a more complete version in September. According to OpenAI’s disclosure document, cloud security company Wiz also found both flaws independently.

Brockman also used the worldwide alarm over the flaws to promote the abilities of GPT, while admitting that the process of releasing information about them did not go smoothly. He said: “Although the final stages of disclosure did not go as planned (the original release date was October 22, but details leaked early, prompting the PHP maintainers to move the release forward to October 21), I am grateful that the alliance secured two full months of preparation time. These fixes were quite complex for PHP, and if the details had leaked long before the patch was ready, the impact would have been severe.”

GPT-5.6 Sol has already been involved in another incident in which it escaped its intended limits. In July, OpenAI said the model, along with another model that had not been released, escaped a locked testing environment during a hacker test. It found a previously unknown security flaw, called a zero-day vulnerability, and took answers directly from Hugging Face’s live production database and the systems of five other major companies.

In September, Australian Prime Minister Anthony Albanese said an OpenAI agent had accessed documents that were not public on the Medicare statistics portal in June. He called the way the incident was reported “unacceptable.” A few days later, OpenAI revealed that its agent had also collected data from U.S. government websites, including the Census Bureau and the U.S. Securities and Exchange Commission (SEC). However, the company said these incidents did not count as security breaches.

OpenAI is now presenting itself as a kind of night watchman for the internet. Brockman used a military term, “OODA loop,” which stands for observe, orient, decide, and act. He said: “The defender needs a tighter OODA loop than the attacker.” He believes this is possible as long as “the defender can use models more powerful than those of the attacker.”

He also suggested that, in the future, authorized security teams, such as government agencies, could scan the internet for vulnerable servers and install fixes remotely in “extreme circumstances.” “Therefore, ensuring that we always have the strongest cybersecurity model should be a national priority,” he said.

To help protect the world from risks caused by AI, OpenAI has promised $1 billion in subsidized access to Daybreak, its AI initiative for teams protecting critical infrastructure. Brockman said the company is also working on “several other significant vulnerabilities,” including a flaw that allows attackers to run code remotely, which Node.js announced on Wednesday.

But PHP will not be the last target. Brockman said, “We expect to discover more such issues in the coming months.” Hopefully, the next process for sharing information about a flaw will go more smoothly. ChatGPT could probably help write the email.