How the security community found the PHP flaws but stumbled across the finish line

Two critical remote code execution flaws in PHP, the scripting language used by an estimated 70% of websites, were discovered in August by security researchers at Calif through OpenAI's Patch the Planet program, which gives open-source projects access to OpenAI's otherwise-gated cybersecurity AI models, and were later verified by OpenAI, Wiz and other security organizations. Companies scrambled Wednesday to patch the flaws, with many sites going dark ahead of the patch release. The companies involved tried to keep the situation under wraps until patches were ready at disclosure time and almost succeeded, but the coordinated process broke down at the moment of truth.

In some ways, the process that uncovered two critical security flaws in the widely used PHP scripting language was a model for how security researchers and AI companies can work together to protect enterprise computing. But at the moment of truth, that process broke down. Companies around the world scrambled Wednesday to patch the flaws https://www.thestack.technology/critical-php-vulnerabilities-poc-released-attacks-starting/ , which could allow attackers to execute code remotely on websites running PHP. By some estimates, that's upwards of 70% of all the sites on the web https://w3techs.com/technologies/details/pl-php?ref=thestack.technology , and lots of sites chose to go dark in anticipation of the release of the patches just to be safe. According to the PHP Foundation, the flaws were discovered through OpenAI's Patch the Planet https://patchtheplanet.org/?ref=thestack.technology program — which allowed open-source projects like PHP access to its otherwise-gated cybersecurity AI models https://www.thestack.technology/cant-get-access-to-gpt-5-6-cyber-palo-alto-networks-will-take-your-money/ — back in August by security researchers at Calif https://calif.io/?ref=thestack.technology , and later verified by OpenAI, Wiz, and another security organizations. Given the speed at which those modern cybersecurity models can produce exploits for newly discovered flaws, the companies involved attempted to keep the situation under wraps until patches could be available right at the time the flaws were disclosed. They almost pulled it off.