OpenAI AI finds critical PHP flaw and pledges $1 billion for defense

The discovery of php2shell

OpenAI recently announced that its generative artificial intelligence (AI) successfully identified a critical vulnerability in PHP. PHP is a widely used programming language that serves as the backbone for a vast number of websites, including small blogs and large e-commerce platforms.

The specific flaw, which has been given the common name 'php2shell,' is considered a serious security risk. As reported by BigGo Finance, the vulnerability belongs to a category that could allow an unauthenticated remote attacker to take over a server. This is achieved by sending a crafted multipart POST request—a type of data transmission—to trigger memory corruption, which can ultimately lead to remote code execution.

The discovery process was a collaborative effort involving multiple technologies. The U.S. security firm Calif used 'Sol,' the top-tier version of OpenAI's 'GPT-5.6' series, to find the first flaw on August 1. Google's 'Gemini' AI was also utilized during the analysis. The vulnerability was officially reported to the PHP development team on August 11, with the two specific CVE identifiers—CVE-2026-109618 and CVE-2026-109619—beginning to circulate on social media and forums around October 20.

A new era of speed

One of the most striking aspects of this discovery is the sheer speed at which AI can perform complex security audits. According to the security company Wiz, a single researcher was able to complete the work in just one week using a combination of Google's and OpenAI's AI models. Previously, a task of this magnitude would have required a full team of human experts working for several months.

This shift in capability creates a dual-edged sword for the internet's security landscape. On one hand, AI allows defenders to find and patch holes much faster than human teams can manually scan code. On the other hand, it means that malicious actors have access to the same high-powered tools. The PHP organization noted that advances in AI have created a situation where both defenders and attackers can find flaws faster than ever before.

Because PHP has such a large installed base of running servers, the risk of a widespread breach is high. If companies are slow to apply the necessary patches, attackers can use automated tools to scan the internet en masse for vulnerable systems. This creates a shrinking window of time between the public disclosure of a flaw and its potential exploitation by bad actors.

The $1 billion defense pledge

Recognizing the severity of this shift, OpenAI is making a significant financial commitment to the security community. The company announced it will commit $1 billion, or approximately ¥160 billion, to support defenders. This funding is intended to help level the playing field as AI becomes the primary battleground for cyber offense and defense.

The support will be distributed through a program called 'Daybreak for Frontline (FRO) Defenders.' This initiative provides discounted access to OpenAI's tools, allowing security teams to use the same AI capabilities that found the PHP flaw to protect their own infrastructure. OpenAI described this specific discovery as one of the most impactful cases in recent memory due to the scale of PHP's reach.

Cloud infrastructure providers are already reacting to the risk. Tencent Cloud issued a risk advisory urging users to update their systems promptly to avoid remote attacks. Similarly, Google stated that while its own cloud infrastructure is not affected, users running PHP on its platform remain at risk. Google's 'Gemini4Argon' was involved in the entire lifecycle of this event, including vulnerability discovery, exploit development, and the verification of patches.

What comes next for web security

The discovery of php2shell serves as a blueprint for how AI will continue to interact with software development. We are moving toward a world where 'AI-assisted auditing' is the standard. For developers, this means that the human role may shift from finding bugs to overseeing the AI's ability to secure code in real-time.

For the general public, this means that the security of the websites we visit will increasingly depend on automated systems. As cloud companies move quickly to issue warnings, the responsibility for security is shifting toward the providers and the software maintainers who must keep up with the pace of AI-driven discovery. The goal is to ensure that the speed of defense stays ahead of the speed of attack.