OpenAI's PHP2Shell critical vulnerability disclosure

Following an early embargo break that left sites exposed before a patch was available, the PHP Foundation released an emergency update on October 21, 2026 for two critical vulnerabilities rated CVSS 9.2, collectively called PHP2Shell, discovered by OpenAI's AI tools through its Patch the Planet initiative. Government websites and the Internet Archive went offline for emergency patching. Brewster Kahle said the Archive used Claude to make fixes for older PHP versions and local models to run simulated attacks before restoring service. Amazon observed active exploitation as early as October 17, four days before public disclosure, and the embargo broke roughly six hours early. An analysis of the top 7.2 million PHP websites found 46.1% run End-of-Life PHP branches that will not receive official fixes. OpenAI's Patch the Planet initiative, part of its Daybreak Cybersecurity Project launched in June 2026, is jointly led with Trail of Bits; HackerOne handled classification and coordinated disclosure. A separate Node.js flaw was also identified through the same effort. OpenAI published a five-stage coordination framework and launched a Patch the Planet site proposing PHP2Shell as a template for handling AI-found critical bugs in widely used software.