Who Found the PHP Bug That Made Governments Unplug Their Websites? ChatGPT, Of Course

In brief

• OpenAI President Greg Brockman said the company led a two-month coalition to fix PHP2Shell, found with its models under its Patch the Planet initiative.
• Security firm Calif used GPT-5.6 Sol to find a version of the bug in August; OpenAI found a fuller version in September, and Wiz found both flaws independently.
• Brockman called for authorized defenders, such as governments, to scan for vulnerable servers and, in extreme cases, patch them remotely.

The two PHP bugs that pushed Finland, the Netherlands, and France to pull government websites offline on Wednesday weren't found by a hacker in a hoodie. They were found by AI—OpenAI's AI, to be specific.

"Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell," OpenAI President Greg Brockman said in a statement. "It was discovered and addressed using our models as part of our Patch the Planet initiative."

The flaws let anyone run their own code on servers running PHP, the language behind about 70% of websites whose server-side language is known. PHP shipped fixes a day after details leaked online.

According to Brockman, the bug sat in PHP for 14 years, and a limited version surfaced in 2024 but "wasn't considered significant at the time." Researchers at security firm Calif, working under Patch the Planet, used OpenAI's GPT-5.6 Sol to find a version of it in August, and OpenAI's own team found a fuller version in September. Cloud security firm Wiz also found both flaws independently, per OpenAI's disclosure.