OpenAI’s Patch the Planet and Wiz report independent PHP2Shell discoveries
[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
What happened
Latent Space reports that Calif researchers working under OpenAI’s Patch the Planet project and Wiz independently discovered two PHP-core vulnerabilities named PHP2Shell. Calif used GPT-5.6 Sol, while Wiz credited Gemini 4 Argon and GPT-5.6 Sol alongside Wiz Atlas. Researchers reported unauthenticated remote code execution against WordPress, Drupal, and Joomla. OpenAI describes approximately two months of coordinated remediation; Cloudflare deployed temporary WAF protections, while the report distinguishes demonstrated exploits from broader, uncorroborated exposure and outage claims.
Why it matters
The account shows how vulnerability discovery translates into coordinated remediation across maintainers and infrastructure providers, with temporary filtering covering known exploit vectors while operators prepare to patch.
Read next
More changes in today’s briefingMicrosoft Research and Collaborator Resolve the KLS Conjecture With Human-Directed AIKeep up with AI, one email a day
Model releases, price changes and compute developments, with original sources. Free, confirmed by email, and easy to unsubscribe. Read a past issue · 2026-10-22