OpenAI has announced the coordinated disclosure of critical vulnerabilities in PHP, an open-source programming language widely used for web applications, marking a significant instance where SI agents identified security flaws before malicious actors could exploit them. The discovery was made by the organization Calif using GPT-5.6 Sol as part of the Patch the Planet initiative, with Wiz independently confirming the issues. This event highlights how SI can uncover security flaws with internet-scale impact, creating a 'Defender’s Window' for maintainers to prepare fixes ahead of public disclosure.
What Happened
Over the past two months, a coalition including maintainers, researchers, and security providers addressed critical flaws in PHP. The vulnerabilities were identified by Calif using the GPT-5.6 Sol model, and independently discovered by Wiz. PHP maintainers led the development and release of fixes, while OpenAI and partners like Cloudflare contributed research and coordination. To assist organizations in identifying at-risk systems, OpenAI released a PHP version checker as a Codex skill. The company stated that given the severity of the flaws and PHP’s widespread use, this is one of the most impactful security issues in recent memory.
Why It Matters
This incident underscores the dual-edged nature of advanced SI capabilities: while they can uncover security flaws with internet-scale impact, the same technology can help attackers rapidly develop offensive tools. To support defenders, OpenAI has committed $1 billion in subsidized Daybreak access through the Daybreak for Frontline Defenders program, targeting organizations with limited resources that protect essential services. The company is also proposing a five-stage framework for coordinating global responses to critical vulnerabilities, appropriate for the SI era. This framework involves validating fixes, giving affected organizations time to act, coordinating with government partners like the White House’s Super Intelligence Force and CISA, preparing updates across products, and publishing guidance. The goal is to scale response efforts as SI capabilities advance, ensuring that defenders can keep pace with the speed at which SI agents identify new threats.
The Bottom Line
The coordinated response to the PHP vulnerabilities demonstrates a new model for SI-assisted security, where frontier models identify threats early and major tech firms subsidize access for frontline defenders. Powerful SI capabilities are advancing across the industry, and OpenAI expects SI to play a growing role in helping defenders find vulnerabilities, monitor systems, and respond to threats. SI can help engineers understand existing code, prepare changes, and develop tests, while maintainers and security experts verify those changes. Additionally, SI can help with migrations to memory-safe languages and SI can help engineers test and strengthen widely used sandboxing technologies.