OpenAI's Patch the Planet Discovers Critical PHP2Shell Vulnerabilities
OpenAI's Patch the Planet program, alongside another party, utilized the advanced GPT-5.6 Sol model to discover critical PHP2Shell vulnerabilities affecting core PHP. This discovery was followed by a coordinated two-month response effort with maintainers to test fixes and prepare guidance. These vulnerabilities affect approximately 70% of the web by threatening the PHP runtime itself, potentially allowing attackers to execute malicious code, expose data, or disrupt services. The incident demonstrates the growing capability and importance of AI models in securing critical open-source infrastructure. The PHP2Shell vulnerabilities involve memory-safety issues that can leave request or global memory in an invalid state after PHP exits an error-handling context. Coordinated protections and patches have been developed to address CVE-2026-109618 and CVE-2026-109619.
## BACKGROUND
Patch the Planet is an initiative where organizations like OpenAI and Trail of Bits combine frontier AI models, security tools, and human engineers to harden critical open-source software. PHP is a widely used scripting language that powers a vast majority of websites on the internet.