OpenAI just published its account of the disclosure behind today's critical PHP security release. It says it led a group of maintainers, researchers, and security companies over the past two months to prepare for the two remote code execution bugs fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

If you haven't updated yet, start with our article on the two vulnerabilities. It covers who is at risk, the fixed versions, and the stopgap settings. This post is about how the bugs were found and how the release came together.

How the Bugs Were Found

According to OpenAI, the security firm Calif found one of the critical flaws using GPT-5.6 Sol, as part of OpenAI's Patch the Planet program. Wiz, a cloud security company, found and reported both vulnerabilities on its own. The PHP advisories credit four reporters in total.

OpenAI says the PHP maintainers led the fixes and the release. OpenAI, Wiz, Cloudflare, and others helped with research, testing, and coordination so protections were ready before the details went public.

OpenAI calls this "one of the most impactful security issues in recent memory," given how serious the flaws are and how widely PHP is used. It also says that, as far as it knows, AI found these bugs before attackers did.

Who Got Told First

The PHP release notes already said Linux distributions and LTS vendors got the patches in advance. OpenAI's post fills in more of that picture. It says the group:

  • Tested the fixes and prepared guidance with the maintainers and research partners
  • Worked with infrastructure providers on protections for affected systems
  • Contacted several parts of the U.S. government, including the White House's Super Intelligence Force, the Office of the National Cyber Director, and CISA, plus international agencies

The Patch the Planet site calls the disclosure php2shell and links to php2shell.com. OpenAI says it's also sharing a PHP version checker and will launch a Codex skill to help you find PHP versions that need the update.

Read More

Read the full post on OpenAI's site for the details, and check the php.net security advisory for the official update instructions.