OpenAI Says AI Helped Uncover Critical PHP Flaws, Urges Operators to Patch

Representative image: AI-generated conceptual illustration.

OpenAI says its security initiative helped identify critical vulnerabilities in PHP, the programming language used by many websites and web applications, and coordinated with maintainers and security partners on fixes.

In an October 21 disclosure, the company said its Calif system identified a critical flaw using an AI model. Security company Wiz independently discovered and reported both vulnerabilities, according to OpenAI. PHP maintainers led the fixes and release; OpenAI said it and other partners contributed research, testing and coordination.

Why the response matters

A vulnerability in widely deployed software can affect operators through many different products and hosting arrangements. OpenAI describes its proposed response as a coordinated process: let maintainers determine who needs advance information, prepare updates and mitigations, then publish guidance that helps operators identify exposure and verify fixes.

The company said that, to its knowledge, the vulnerabilities were discovered by frontier AI before attackers. That is OpenAI’s assessment, not independent proof that no attacker knew of them. The company also warned that similar capabilities could help attackers develop exploits.

What operators should do

Organizations using PHP should inventory exposed systems and follow the PHP project’s official security and release guidance and their hosting provider’s instructions. Apply the appropriate supported updates and verify that the running version has actually changed. Temporary mitigations can reduce risk but do not automatically replace a patch.

OpenAI has also published a version-checking tool, but operators should validate any automated recommendation against their actual deployment and maintainer guidance.