Developing
OpenAI sells the models and security access it describes; CVE numbers, the finding's date and how the model was used are not in its page.
In 60 seconds
- PHP fixes shipped on October 21 at 13:30 UTC, per CERT-EU; OpenAI says Calif found one flaw with GPT-5.6 Sol and credits Wiz with independently finding both.
- OpenAI says "to our knowledge, frontier AI found these vulnerabilities before attackers did".
- Cloudflare says its firewall blocked exploit attempts from 3:02 UTC and that the flaw leaked; it credits four finders including Quarkslab, which OpenAI omits.
- OpenAI proposes a five-stage framework for coordinating AI-discovered vulnerabilities and restates a $1 billion subsidised Daybreak access commitment.
Impact Layer
- What changed
- A frontier AI lab has publicly claimed credit for helping find critical vulnerabilities in widely used software.
- Why it matters
- PHP runs a large share of websites, including WordPress, so marketing teams with their own sites need patches regardless of who found the flaw.
- Who is affected
- Website owners, developers and security teams, and CMS administrators.
- Martech stack area
- AI, CMS
- Stack impact
- Check your PHP version and patch to the fixed releases. Do not rely on a firewall alone.
- Business impact
- High PPC Land's analysis of OpenAI's own page. There is no third-party verification of the claim, and CVE identifiers, affected versions, discovery dates and prompts are not in OpenAI's page.
- Related technologies
- Related vendors
- What to watch
- Independent reviews of the claim and OpenAI's framework.
OpenAI published its account of two critical PHP flaws on October 21, 2026, the day PHP fixes shipped at 13:30 UTC, according to PPC Land citing CERT-EU.
OpenAI’s account
- Security firm Calif found one flaw using GPT-5.6 Sol under OpenAI’s Patch the Planet initiative; Wiz independently found and reported both.
- OpenAI says it led a coalition of maintainers, researchers and security providers for about two months, and that “to our knowledge, frontier AI found these vulnerabilities before attackers did”.
- It proposes a five-stage framework for coordinating AI-discovered vulnerabilities, restates a $1 billion subsidised Daybreak access commitment first announced September 3, and offers a PHP version checker for Codex.
What Cloudflare reported
Cloudflare said its firewall blocked exploit attempts from 3:02 UTC the same day, that the flaw leaked and that attack traffic targeted its customers. It credits four finders, including Quarkslab. OpenAI’s page mentions neither the leak nor the attacks.
Not stated in OpenAI’s page
CVE identifiers and affected and fixed PHP versions, the date Calif made its finding, the total number of Patch the Planet findings and false-positive rates, how the model was used, and how the $1 billion has been allocated.
Our read
Whoever found it, the action is the same: update PHP. Treat the AI-credit claim as a vendor statement until others check it.
Sources
- PPC Land: OpenAI says GPT-5.6 Sol found a PHP flaw before attackers did (opens in a new tab)
Source for OpenAI's account, Cloudflare's contradicting details and what is missing.