OpenAI today published its own account of the PHP vulnerabilities that dominated security news on October 21, 2026, saying that one of the two critical flaws was identified by the security firm Calif using GPT-5.6 Sol, one of OpenAI's models, under a programme called Patch the Planet. The company says it spent two months leading "a coalition of maintainers, researchers, and security providers" ahead of disclosure, and it used the occasion to propose a five-stage framework for handling AI-discovered vulnerabilities in widely used software, which it is asking the security community to critique.

In Short

A company called Calif used one of OpenAI's AI models to find a serious hole in PHP, the software that runs a large share of the world's websites, and another firm, Wiz, found both holes on its own. OpenAI says the AI got there before criminals did, which gave PHP's volunteers time to build fixes, although Cloudflare said the same day that the flaw leaked and attackers went after its customers. OpenAI now wants the security world to help write rules for who gets warned first when AI keeps finding bugs like these, and it is offering $1 billion worth of discounted access to its security AI for organisations with small security teams.

A vendor's account of the PHP response

The page, titled "Patch the Planet: global response coordination as agents uncover critical vulnerabilities," is dated October 21, 2026 and tagged Security and Product. Its author is listed simply as OpenAI. It arrives on the same day that the US National Security Agency and CERT-EU, the cybersecurity service of the EU institutions, issued advisories on two PHP flaws, and on which Cloudflare said its firewall had been blocking exploit attempts since 3:02 am UTC.

OpenAI's opening claim is broad. "Over the past two months, we led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications," according to the company. The attribution of discovery is narrower and more specific: "Calif identified a critical flaw using GPT-5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities."

That sentence carries a distinction worth reading slowly. According to OpenAI, Calif found one flaw with an OpenAI model. Wiz found both, independently. The page does not say which of the two flaws Calif found, does not say who found the other one first, and does not say whether Wiz used AI.

OpenAI is careful about who did the repair work. "PHP's maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure," according to the page.

It is a source with an interest. OpenAI sells access to the models and the Daybreak security offering it describes, and every claim on the page about how the vulnerabilities were found, and in what order, comes from the vendor. The page offers no third-party verification of those claims.

The severity claim

OpenAI does not give a severity score. It gives a judgement. "Given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory," according to the company. It adds that the episode "highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits."

The central claim of the page is about timing. "To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender's Window for maintainers and security providers to prepare fixes and protections ahead of disclosure," according to OpenAI. The phrase Defender's Window links to an earlier OpenAI post of that name, dated August 17, 2026.

What the page does not contain

For a document about a specific security incident, the page is light on incident specifics. It names no CVE identifiers. It names no PHP version numbers, either affected or fixed. It does not use the name php2shell anywhere in its text, although one of its links points to a GitHub repository at github.com/openai/php2shell-checker, the version checker OpenAI says it is sharing "as a Codex skill to help operators identify potentially vulnerable PHP versions." It gives no date on which Calif made its finding, and no date on which the PHP project was notified.

It also leaves out the scale of the wider programme. "As significant as they are, these bugs are among several significant vulnerabilities we've already found and are working to fix, and we expect similar findings to increase sharply in the coming months," according to OpenAI. "Several" is not a number. The page does not say how many vulnerabilities Patch the Planet has found in total, in which other software, how many have been disclosed, how many findings turned out to be false positives or duplicates, or whether any were exploited before fixes shipped.

Nor does it describe how GPT-5.6 Sol was used. There is no account of the prompts, the harness, the amount of human review, or how long the model ran before producing the PHP finding. The title refers to "agents," but the body of the page does not describe an agent at work on PHP.

Where OpenAI's account differs from the others

PPC Land compared OpenAI's page with the three other primary accounts published on the same day: CERT-EU's Security Advisory 2026-018, the NSA's five-sentence statement, and Cloudflare's blog post on its WAF protections. None of the differences proves an error, but several change how the story reads.

Who found the flaws. Cloudflare's post credited four organisations with disclosing the two PHP vulnerabilities: Calif.io, Wiz, OpenAI and Quarkslab. OpenAI's page names Calif and Wiz as finders, names itself as coordinator, and does not mention Quarkslab at all. CERT-EU and the NSA named no researchers.

Whether attackers were first. OpenAI says that, to its knowledge, frontier AI found the vulnerabilities before attackers did. Cloudflare wrote that the flaw leaked before the official release date, that it observed attack traffic aimed at its customers, and that attackers were mutating payloads to evade its rules. CERT-EU said proofs of concept had begun to circulate, which in its assessment made exploitation more likely. These statements are not strictly incompatible: a flaw can be found first by defenders and then leak before release. But OpenAI's page does not mention the leak, or any attack traffic, at all.

How long the work took. OpenAI says it led the coalition "over the past two months," which would put the start in roughly late August 2026. Cloudflare said it had been developing and deploying WAF protections since early October 2026. CERT-EU said the PHP project pre-announced the security release on October 20, and that fixes shipped at 13:30 UTC on October 21. The two-month figure and the early October figure may describe different starting points, discovery in one case and Cloudflare's involvement in the other, but none of the documents says so.

Which governments were involved. OpenAI names "the White House's Super Intelligence Force, the Office of the National Cyber Director (ONCD), the Cybersecurity and Infrastructure Security Agency (CISA), as well as international partners." It does not name the NSA, which issued its own advisory the same day, or CERT-EU. The NSA statement asked organisations to be ready for an update, wording that read as if fixes were still to come. OpenAI's page, published after the fixes, says "the priority now is applying the fixes."

The checker tool. CERT-EU pointed operators to a php2shell repository maintained by NCSC-NL, the Dutch National Cyber Security Centre, for identifying third-party software that embeds PHP. OpenAI points to its own checker, packaged as a skill for Codex, its coding product. The two tools appear to serve different purposes, one listing products and the other checking PHP versions, but the overlap in naming may cause confusion.

The model name. The page attributes the finding to "GPT-5.6 Sol." The site footer captured in the same document lists GPT-6.1 Sol, GPT-6 Astra, GPT-5.6 and GPT-5.5 under Latest Advancements, but no model called GPT-5.6 Sol. The page does not explain the naming.

The five-stage framework

The second half of the page is a proposal rather than a report. OpenAI says some findings can be handled directly between a researcher and a maintainer, while others need "a wider response because they affect many products or because distributors and service providers need time (which may be in short supply if frontier capabilities are not too far ahead of those that are broadly available) to prepare updates and protections."

That parenthetical is the clearest statement of the problem the framework is meant to address. If a frontier model can find a flaw, and a widely available model can find the same flaw a few months later, the window for quiet coordination shrinks to that gap.

For those wider cases, OpenAI proposes that "the response can involve five stages":

  1. Validate and fix the upstream vulnerability. The maintainer, researchers and "essential technical partners" confirm the finding, assess its impact, and build and test a fix. According to OpenAI, "this process includes adversarial testing with frontier models to look for ways around the patch and related variants of the vulnerability."
  2. Give affected organisations time to act. OpenAI proposes "a framework for considering which organizations need advance information to prepare protections, while maintainers decide whom to involve." Its examples are a distributor adapting a fix for an older release, a hosting provider testing a mitigation, and a security provider preparing detection or prevention measures, "including web application firewall (WAF) rules." Cloudflare's 3:02 UTC deployment fits that description.
  3. Coordinate with government partners. This is the stage under which OpenAI names the White House body, ONCD and CISA.
  4. Prepare updates across affected products. As the fix and disclosure plans stabilise, maintainers can bring in additional distributors, hosts, service providers, response teams and operators.
  5. Publish guidance and support deployment once a patch exists. According to OpenAI, "the response continues as operators deploy updates and report where they need help."

Who gets told, and what they get

The selection criteria are stated in general terms. "The proposed framework considers an organization's protective role, including protecting its own systems and customers, the time needed to act, and its ability to handle sensitive information," according to OpenAI. "The same criteria would apply to comparable organizations, with maintainers deciding whom to involve ahead of disclosure."

What each participant receives varies sharply. "Each participant receives the information needed to carry out their protective work, from network logs with indicators of compromise to more sensitive working proof-of-concept exploits," according to the page. OpenAI acknowledges the risk in that range: "Even limited details can reveal a vulnerability, so we weigh the risk of sharing them against the protection they enable."

The page lists the conditions under which a timeline would be reconsidered: "active exploitation in the wild, a leak, a revealing public patch, or increased risk to users from stalled remediation." Two of those, a leak and active exploitation, are what Cloudflare said happened in the PHP case. OpenAI's page does not say whether the PHP timeline was reassessed as a result.

There is a structural question the page raises but does not settle. Under the framework, maintainers decide whom to involve, but OpenAI says "we help with outreach, information-sharing agreements, and coordination between teams." For a volunteer project, the party that drafts the agreements and makes the introductions has considerable influence over who ends up on the list, and in the PHP case that party was also the company whose model was credited with a discovery.

The Patch the Planet website and CISA

OpenAI says a Patch the Planet website, linked on the page as patchtheplanet.org, "brings together public disclosures and guidance to help operators identify affected systems, find the right update, and verify that the updated software is running properly." For PHP, according to OpenAI, it points to the maintainers' official patch and upgrade instructions and partners' technical research, and covers interim mitigations, when to involve a provider, and backup and recovery. "Interim protections can reduce risk, but we'll make their limits and operational tradeoffs clear," the page states. PPC Land has not reviewed the site for this article.

The page refers operators to "CISA's guidance on prioritization and remediation." The link goes to a CISA directive page whose address identifies it as BOD 26-04 and refers to prioritizing security updates based on risk. According to OpenAI, that guidance can mean "emergency patching, immediate mitigation, or a planned update, alongside forensic triage where warranted to assess whether systems have already been compromised."

Money, models and maintainers

The page sets out several commitments, most of them described as access rather than cash.

Daybreak for Frontline Defenders. "To help more defenders use these capabilities, we've committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, focused on organizations with limited security resources protecting essential services," according to OpenAI. The phrase links to a post of the same name dated September 3, 2026, so the commitment predates the PHP disclosure. The words "Daybreak access" link to an OpenAI form for enterprise trusted access for cyber. The page does not say how much of the $1 billion has been allocated, to whom, or how the subsidy is valued.

Codex for OSS. OpenAI lists "subscriptions for all maintainers through Codex for OSS," linked to an application form.

Direct sponsorship. The page names "direct sponsorship of projects such as the Rust Foundation for maintainers and technical work." The link goes to a Rust Foundation page whose address refers to OpenAI joining as a Platinum member and a donation to the Rust Project. No amount appears in the OpenAI page.

Hands-on support. "Open-source projects can apply to Patch the Planet for hands-on support," according to OpenAI. The application link points to a page on the website of Trail of Bits, a security consultancy, rather than to OpenAI. The page does not describe Trail of Bits' role.

The rationale is the economics of volunteer software. "Many projects are run by small teams that review security reports alongside routine development," according to OpenAI. "Those teams need help separating new issues from duplicates, assessing impact, and testing fixes across supported releases." An increase in AI-generated reports adds to exactly that workload, which the page acknowledges indirectly when it says it expects findings "to increase sharply in the coming months." The page names no figure for the funding it provides to maintainers.

Blocking classifiers

The same capability cuts both ways, and OpenAI says it is "calibrating additional blocking classifiers for Daybreak to help reduce the potential for misuse." It concedes a cost: "safeguards intended to prevent abuse can also block legitimate security work." The page gives no false-positive rate for the classifiers and no date for their deployment.

Longer-term aims

A section titled "Building more secure software foundations" lists four areas where OpenAI sees AI helping. They are secure code from the start, where coding models help developers "choose safer defaults"; memory-safe software, "moving critical components to memory-safe languages"; formal verification, where "mathematical proofs can show that critical components satisfy specified security properties under stated assumptions"; and stronger isolation, "running software that processes untrusted files, images, or media in tightly restricted sandboxes."

The memory-safety item is directly relevant to the PHP case. Both PHP flaws, as CERT-EU and Cloudflare described them, involve memory handled incorrectly after a request is interrupted, the class of error that memory-safe languages are designed to prevent. OpenAI's page does not draw that connection itself.

Questions OpenAI puts to the industry

The final section asks for input, with "examples from past disclosures" described as "especially useful." Four topics are named:

  • Disclosure windows. "How much time do maintainers, operators, and defenders need to prepare and deploy reliable fixes?"
  • Emergency patching. "When, if ever, should governments or other operators use a vulnerability to patch systems they own or are authorized to manage after losing administrative access?" OpenAI goes further: "We can imagine an end-state of internet-wide always-on scanning for known vulnerabilities, and either notifying site owners when one is detected or patching the system."
  • Early notice. "When do staged notifications work better than notifying a wider group at once, and how should we weigh coverage against leak risk?"
  • Secure-by-default software packages. How to fix vulnerabilities in downstream packages while upstream fixes are pending, or backport fixes "to older versions that no longer receive security updates."

The emergency patching idea is the most consequential item on the page, and it is phrased as a question rather than a proposal. Patching a system through its own vulnerability means exploiting it, even with benign intent. The page limits the scenario to systems the patching party owns or is authorised to manage, but the "end-state" sentence about internet-wide scanning followed by "patching the system" does not repeat that limit. Feedback is collected through a Google Form linked from the page, and OpenAI also asks for recommendations of "independent security experts who can review the approach, challenge its assumptions, and identify gaps."

Why this matters for marketers and publishers

PHP sits under much of the web that advertisers buy and publishers run, from WordPress content sites to landing pages and checkout flows. Earlier today PPC Land reported that the NSA and CERT-EU described both PHP flaws as allowing unauthenticated remote code execution, and that Cloudflare had pushed firewall rules to customers on every plan. OpenAI's page adds a claim about origin: that the discovery came from an AI model sold by the company publishing the account.

That claim fits a pattern PPC Land has followed through 2026. In June, PPC Land reported on a Firefox security harness that fixed 271 bugs found with Anthropic's Claude Mythos Preview, a model that was not publicly available. In August, Google's CodeMender agent was reported to have upstreamed 72 security fixes to open source projects in its first six months. Each of those accounts, like OpenAI's, came from the AI developer or a close partner.

Washington has been building machinery around the same capability. A draft White House AI cybersecurity order published in May proposed an AI cybersecurity clearinghouse to coordinate vulnerability scanning, validation and patch distribution, and OpenAI was reported to have supported it. The order signed on June 2 kept that clearinghouse, involving the National Cyber Director, the NSA and CISA, and directed CISA to issue Binding Operational Directives. OpenAI's page does not mention the clearinghouse, and the "Super Intelligence Force" it names does not appear in PPC Land's coverage of either order.

For the industry, the practical issue is less about which lab found which bug than about who hears first. A framework in which advance notice goes to hosting providers, distributors and security vendors, with the AI developer helping to draw up the list, would determine whether a publisher's host, a retailer's platform or an agency's managed WordPress provider is inside the window or outside it. Large parts of the open-source stack that marketing technology depends on are maintained by small volunteer teams, the group OpenAI says it wants to help, and the group that would carry the extra load of AI-generated reports.

The PHP episode also shows the limits of the window. OpenAI says AI found the flaws first. Cloudflare says they leaked and were attacked before the official release. Both may be true, and the gap between them is the period that the five-stage framework is supposed to manage.

Timeline

Summary

Who: OpenAI, describing a coalition it says it led with PHP's maintainers, the researchers Calif and Wiz, Cloudflare and others, and its engagement with the White House's Super Intelligence Force, ONCD and CISA. OpenAI sells the models and Daybreak security access it describes.

What: An account of the PHP vulnerability response, in which Calif found one critical flaw using GPT-5.6 Sol and Wiz independently found both, according to OpenAI, plus a five-stage framework for coordinating AI-discovered vulnerabilities, a PHP version checker packaged for Codex, a restated $1 billion subsidised Daybreak access commitment, and an open request for feedback on disclosure windows, emergency patching, early notice and secure-by-default packages.

When: Published today, October 21, 2026, the day PHP fixes shipped at 13:30 UTC and the NSA, CERT-EU and Cloudflare issued their own accounts. OpenAI says the coalition worked over the preceding two months.

Where: PHP, used by websites and web applications worldwide; the coordination involved US federal bodies and unnamed international partners. Guidance is collected on the Patch the Planet website.

Why: According to OpenAI, frontier AI found the flaws before attackers did and opened a window for fixes, and it expects similar findings to "increase sharply in the coming months." The page gives no count of findings, no third-party verification, no false-positive rates and no mention of the leak and attack traffic that Cloudflare reported the same day.