OpenAI launches a plan to find and fix hidden security flaws online

OpenAI announced a plan called Patch the Planet on Wednesday, aimed at finding and fixing hidden security flaws in old software. It landed the same day an emergency patch came out for two serious flaws in PHP, known as PHP2Shell. They were reportedly found with OpenAI's GPT-5.6 Sol model.

What happened with PHP

PHP is a technology that powers as much as 70% of the world's websites. If hackers exploited the two flaws, they could take control of web servers, the computers that deliver a website to visitors. The security company that built PHP issued an emergency patch, which is a software fix, on Wednesday. OpenAI called PHP2Shell "one of the most impactful security issues in recent memory."

What Patch the Planet includes

OpenAI describes the plan as a framework for global cooperation after new threats are found. Security professionals, vulnerable organizations and government agencies would work on fixes together. OpenAI is also asking outside experts to review the approach, challenge its assumptions and spot gaps. A new website will host public disclosures and patch information. Other pieces:

• OpenAI will put $1 billion toward subsidizing Daybreak, its security auditing tool, for groups with limited security resources that protect essential services.
• A Codex skill on GitHub can check whether websites have been compromised by PHP2Shell.

A tool that cuts both ways

OpenAI says the same AI abilities that find flaws can also help attackers build tools to exploit them quickly. The company says PHP2Shell is one of several significant vulnerabilities it has already found. It expects similar findings to "increase sharply in the coming months." Gizmodo notes the tension: OpenAI races to build this technology while also presenting itself as a front-line defender. Whether AI helps defenders or attackers more is still an open question.

OpenAI also said in a Monday blog post that its newest models, including GPT-6 Astra and GPT-5.6 Sol, are much better at translating old programming languages like COBOL and Fortran into newer ones. Banks and much of the public sector rely on software written in those languages.

What to do

If your business website runs on PHP, ask your web provider whether the emergency patch has been installed. The material does not say how many sites are affected or whether attackers have already used the flaws, so confirming the patch is the safest step.