OpenAI's AI Finds Critical PHP Vulnerability; $1 Billion Pledged to Help Defenders

OpenAI announced on the 21st that generative artificial intelligence (AI) had helped find a critical security flaw in PHP, a programming language used by websites around the world. The flaw is very serious because it could let attackers take control of servers over the internet. OpenAI also said it would commit $1 billion (about ¥160 billion) to help security defenders. This highlights how AI is becoming a major tool for both people who attack computer systems and those who protect them.

OpenAI said that the U.S. security company Calif found the flaw using "Sol," the top-level version of its "GPT-5.6" series of AI models. The first flaw was found on August 1 and reported to the PHP development team on August 11. The company also said Google's generative AI, "Gemini," was used in the analysis.

The organization responsible for PHP said it had received many reports of security flaws since August. It noted that advances in AI mean that "both defenders and attackers can find flaws faster than ever before."

Wiz, a security company owned by Google, also said it had independently found the flaw using AI from Google and OpenAI. According to the company, a task that had previously taken a team of experts several months was completed in one week by a single researcher using AI.

The flaw is commonly known as "php2shell" and has been given two identifiers: CVE-2026-109618 and CVE-2026-109619. Tencent Cloud, a Chinese cloud service provider, issued a security warning on the evening of the 21st. It explained that an attacker could send a specially designed multipart POST request without logging in. This could damage computer memory and might eventually let the attacker run code on the affected system from a distance. Tencent Cloud urged users with affected systems to install updates as soon as possible.

The official PHP organization said the two CVE identifiers began appearing on online forums and social media at around 3 p.m. UTC on October 20. Google said the two flaws do not affect Google's own cloud infrastructure, but warned that customers running PHP on its platform could still face risks. Google also said its "Gemini4Argon" was used throughout the process, including finding the flaws, developing ways to exploit them, detecting attacks, and checking software fixes.

Because the flaw is so serious and PHP is so widely used, OpenAI described it as one of the most significant cases in recent memory. It will help security defenders by offering discounted access through its "Daybreak for Frontline (FRO) Defenders" program.

Item	Details
AI used for discovery	OpenAI "GPT-5.6 Sol," Google "Gemini"
Common name / CVE	php2shell / CVE-2026-109618, CVE-2026-109619
First report	Discovered August 1, reported to PHP development team August 11
Attack method	Memory corruption and remote code execution via crafted multipart POST requests
Scale of OpenAI support	Discounted access worth $1 billion (about ¥160 billion)

Note: The common name and CVE identifiers are based on Tencent Cloud's warning. The discovery dates are based on statements from OpenAI and the U.S. security company.

PHP has been used for many years to build small and medium-sized web services, such as blogs and online shopping sites. As a result, many servers around the world run PHP. If security updates are not installed quickly, attackers could use automated tools to scan large numbers of systems and find those that are still vulnerable. AI can help defenders find flaws and fix them faster, but attackers can use the same tools. This raises concerns that the time between a flaw becoming public and attackers using it could become shorter. Cloud companies issued warnings one after another because they believe that when customers fail to respond to security threats, the damage could spread more widely.