Patch the Planet: OpenAI models in the critical PHP flaw disclosure
-
2026-10-21: opened — OpenAI says its models, under the "Patch the Planet" initiative, helped researchers discover critical PHP security flaws affecting an estimated 70% of websites, via a two-month pre-disclosure coalition and a major PHP engine change it calls the "Defender's Window in action" (https://x.com/OpenAI/status/2112907856018309586); Google DeepMind's relay of Raluca Ada Popa names "PHP2Shell," CVSS 10, Wiz Research's discovery, and a leading role for Gemini 4 Argon (https://x.com/GoogleDeepMind/status/2112942536553599429) — an attribution the posts do not reconcile.
-
2026-10-22 (~11:41 AM ET — https://x.com/AravSrinivas/status/2113294604456051111): Perplexity productizes PHP2Shell into a scanning skill — Computer's new PHP2Shell skill checks PHP sites and GitHub deployment configs for exposure and prioritizes fixes; /php2shell-exposure-check tasks free through October 31, up to 5,000 credits per user, live for all users in the skills marketplace. The 21 October disclosure became a rival platform's end-user tool inside a day. Threat tail: Cloudflare CEO Matthew Prince's stats (via steipete RT, ~9:25 PM ET Oct 21 — https://x.com/steipete/status/2113299667320787005) put exploitation attempts across Cloudflare's network at thousands in the ten hours before public announcement, tens of thousands within 45 minutes after, hundreds of thousands within two hours, and millions now. Watch: scan-volume or adoption figures from Perplexity; whether exploit traffic decays as the disclosure's fixes propagate.