OpenAI coordinates fixes for critical PHP flaws found with GPT-5.6 Sol under Patch the Planet

OpenAI reported on 21 October 2026 that over the preceding two months it led a coalition of software maintainers, security researchers and infrastructure providers to patch critical vulnerabilities in PHP. Security researcher Calif identified a critical PHP flaw using GPT-5.6 Sol as part of OpenAI’s Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities.

PHP’s maintainers developed and released the upstream patches while OpenAI, Wiz, Cloudflare and other partners tested the fixes for bypasses, prepared web-application firewall rules and wrote operator guidance ahead of public disclosure. OpenAI also coordinated with U.S. and international government agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), the Office of the National Cyber Director (ONCD) and the White House’s Super Intelligence Force, to reach critical-infrastructure operators. Based on the effort, OpenAI published a five-stage coordinated disclosure framework and a central guidance site at patchtheplanet.org.

Alongside the advisory, OpenAI released php2shell-checker on GitHub under the Apache License 2.0, providing a Node.js CLI and two Codex skills (phpcheck-url and phpcheck-server) that inspect HTTP response headers or local php -v output against the patched version cutoffs. OpenAI also noted its $1 billion commitment in subsidised Daybreak access for frontline defenders and Codex for OSS subscriptions for open-source maintainers.