Patch the Planet: Collaborative Fix for Open-Source Critical Vulnerabilities

Patch the Planet links security researchers, maintainers, and incident responders to coordinate efforts in addressing critical vulnerabilities across open source projects. This aims to enhance the efficiency of security response for critical infrastructure.

OpenAI detailed a blueprint aimed at empowering cyber defenders through frontier AI, alongside implementing stronger safeguards, modernizing cybersecurity, and building more resilient public institutions to address escalating cyber threats.

Two parties, Ryan Austin from Calif (as part of OpenAI's "Patch the Planet" project using GPT-5.6 Sol) and Wiz (using Gemini 4 Argon and GPT-5.6 Sol), independently discovered two PHP-engine memory-corruption vulnerabilities, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), almost two months ago. These defects are in PHP's internal handling of out-of-memory conditions and fatal errors, not in CMS plugins, and demonstrations showed pre-authentication RCE against WordPress, Drupal, and Joomla, potentially affecting 70% of the web through a coordinated ecosystem response.

OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon identified a critical PHP vulnerability as part of the Patch-the-Planet initiative. The AI models discovered the flaw before attackers, enabling developers and security vendors to respond. Large language models lower the barrier for attackers to adapt exploits across different PHP configurations.

OpenAI President Greg Brockman stated that the company led a two-month coalition to mitigate the severe open-source software bug, php2shell, as part of its Patch the Planet initiative. A version of the bug was found by security firm Calif using GPT-5.6 Sol in August, and OpenAI's team found a fuller version in September. The flaws allowed code execution on servers running PHP, which powers about 70% of websites. This vulnerability caused governments in Finland, the Netherlands, and France to take government websites offline on Wednesday.

The U.S. National Security Agency warned of two critical holes in PHP, a server-side language powering roughly 70% of the internet's websites, including those using WordPress. These flaws, present in all PHP versions since 5 (released in 2004), allow attackers to infiltrate server file systems or databases. OpenAI found one flaw using GPT-5.6 Sol as part of its “Patch the Planet” initiative, while Google Wiz used its Wiz Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol to find multiple vulnerabilities. The current supported version is 8.5.12, and unpatched sites should be taken offline immediately. OpenAI and Wiz confirmed researchers found these before hackers, but Wiz warned that AI lowers the barrier for exploitation.