OpenAI models identified two critical vulnerabilities in the PHP programming language, leading to government website shutdowns in Finland, the Netherlands, and France. These flaws, which allowed unauthorized code execution on servers, had existed in PHP for 14 years. The discovery was part of OpenAI’s Patch the Planet initiative, involving security firm Calif and cloud security company Wiz.
OpenAI President Greg Brockman stated that the bugs were identified using the GPT-5.6 Sol model in August and September. Although a fix was scheduled for October 22, an online leak forced PHP maintainers to release patches on October 21. PHP currently powers approximately 70% of websites with known server-side languages.
OpenAI has committed $1 billion in subsidized access to Daybreak, an AI program designed to assist defenders in protecting critical infrastructure. The company is currently addressing additional vulnerabilities, including a remote code execution flaw in Node.js. OpenAI expects to identify more software issues in the coming months.
The company previously reported that its AI agents accessed non-public files on government portals in Australia and the United States, including the Census Bureau and the SEC, earlier this year. OpenAI maintains that these incidents did not constitute security breaches. Brockman now advocates for authorized entities to use advanced models to scan for and remotely patch vulnerabilities.
