OpenAI's discovery of PHP vulnerabilities led to government website shutdowns in Europe as a precautionary measure against security threats.
AI Uncovers Major PHP Security Flaws
OpenAI's recent discovery of critical vulnerabilities in PHP, known as php2shell, prompted several European governments, including Finland, the Netherlands, and France, to take their websites offline. This action was necessary to mitigate potential security threats posed by these flaws found in a widely used programming language.
Greg Brockman, President of OpenAI, revealed that the company spearheaded a coalition for two months under its Patch the Planet initiative to address these vulnerabilities. The initial version of the bug was identified by a team at security firm Calif using OpenAI's GPT-5.6 Sol model in August, while OpenAI's team discovered a more comprehensive version in September. Cloud security firm Wiz also independently identified both flaws.
Brockman emphasized the significance of this bug, which had existed unnoticed in PHP for 14 years, stating that a limited version had appeared in 2024 but was not deemed serious at the time. The PHP development team promptly issued fixes following the disclosure of these vulnerabilities.
Despite the successful discovery and mitigation efforts, Brockman acknowledged that the situation became chaotic when details about the vulnerabilities began leaking ahead of the planned announcement, which was originally set for October 22. He expressed gratitude that the coalition had time to prepare, as the fixes were complex and a premature leak could have had severe consequences.
In a broader context, Brockman called for a proactive approach to cybersecurity, urging authorized entities, such as government bodies, to actively scan for vulnerable servers. He suggested that in extreme cases, these defenders might need to patch systems remotely. OpenAI is also investing $1 billion in its Daybreak program, aimed at providing AI tools for those safeguarding critical infrastructure.
Looking ahead, Brockman indicated that more vulnerabilities are likely to be uncovered in the coming months, reinforcing the need for robust defenses against potential cyber threats. "We expect to find many more such issues over upcoming months," he stated, highlighting the ongoing challenge of securing software systems against emerging vulnerabilities.
