Security researchers identified critical vulnerabilities in PHP that allowed unauthorized remote code execution. The flaws were discovered by OpenAI using AI models as part of the Patch the Planet initiative. The most severe exploitation scenario involved mod_php, which could be triggered before application code execution.
On October 21, the PHP team released emergency updates for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These patches address two specific issues: memory corruption due to insufficient memory and use-after-free errors. OpenAI also released a diagnostic tool called php2shell-checker on GitHub to help administrators verify their systems.
The remediation process spanned approximately two months and involved coordination between PHP developers, companies including Calif, Wiz, and Cloudflare, the US Cybersecurity and Infrastructure Security Agency (CISA), and the White House. This collaborative effort ensured that patches were ready before the vulnerabilities were publicly disclosed.
OpenAI now proposes establishing this collaborative model as a standard protocol for disclosing critical vulnerabilities found by AI. The company aims to create a structured framework that enables faster information sharing between developers, security researchers, and government agencies to mitigate risks before technical details become public.
