What the AI world thinks about the PHP2SHELL bug

OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors. Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare. https://t.co/TW3jrSbB3f

Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell, found as part of our Patch the Planet initiative. https://t.co/rBsz7lrlwo

An OpenAI model just helped find what the company calls "one of the most impactful security issues in recent memory." The target was PHP, the language behind WordPress and nearly 70% of websites. Security firm Calif pointed GPT-5.6 Sol at PHP’s code, and it found a critical flaw that could let attackers take over a server without logging in. Wiz found the same bugs independently. OpenAI then spent two months coordinating the response with PHP’s maintainers, Wiz and Cloudflare. Patches dropped this morning after details leaked early, but any server that hasn’t updated is still exposed. The National Security Agency told organizations that can’t update yet to take their systems offline.

I pre-emptively disconnected ALL my sites / VPS servers from the web I'll wait for the patch to hit at 2 PM UTC If you have a PHP website, probably good to take them down until you patch PHP 69.3% of the web runs on PHP so this is going to be intense! Good time maybe to buy cybersecurity stocks? (not financial advice)

Some people say this will be the end of PHP I don't think so because these AI-assisted vulnerability exploits will now increasingly happen to any language, any framework, any server software etc. I mean Node patched a high security vulnerability this week too A new era of infinite cat and mouse games between people assisted by super intelligent AI trying to hack every single app, site and server and on the other side companies trying to defend themselves from it also assisted by AI A new era of cybersecurity has begun

you have a moral responsibility to educate your family & friends on what is going on in cyber rn. it is only going to get worse/weirder from here. here’s a great starter todo list to share: https://t.co/HWOKJBfr5I

A visible sign of what AI insiders have been warning about since at least the Mythos release. Acceleration of attack and defense, at inhuman speeds, interacting with the very human systems that need to react to them. https://t.co/jEI8WDjslo

After cracking all the math problems, Frontier Labs is running an unprecedented operation in the history of computing They have deployed teams of millions of agents powered by their top models to find vulnerabilities So yes, the good news is that they found some, and now everyone is scrambling to fix it!

The take-off has begun, millions of agent swarms tried to exploit the PHP2SHELL hole a few hours after post. There are more 10 out of 10 security vulnerabilities in the last week than what typically happens over years. I don’t think the world is ready for this. Black October https://t.co/5kdMsnBEVj