OpenAI · France · GPT · ChatGPT · Greg Brockman · Calif · Decrypt
Who Surfaced the PHP Bug That Made Governments Unplug Their Websites? ChatGPT, Of Course
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
★ Tier-1 Source
The two PHP bugs that pushed Finland, the Netherlands, and France to pull government websites offline on Wednesday weren't found by a hacker in a hoodie.
Key facts
- According to Brockman, the bug sat in PHP for 14 years, and a limited version surfaced in 2024 but "wasn't considered significant at the time
- To protect the world from the dangers of AI, OpenAI has committed $1 billion in subsidized access to Daybreak, its AI program for defenders protecting critical infrastructure
- The flaws let anyone run their own code on servers running PHP, the language behind about 70% of websites whose server-side language is known
- Researchers at security firm Calif, working under Patch the Planet, used OpenAI's GPT-5.6 Sol to find a version of it in August, and OpenAI's own team found a fuller version in September
Summary
OpenAI President Greg Brockman said the company led a two-month coalition to fix PHP2Shell, found with its models under its Patch the Planet initiative. Security firm Calif used GPT-5.6 Sol to find a version of the bug in August; OpenAI found a fuller version in September, and Wiz found both flaws independently. Brockman called for authorized defenders, such as governments, to scan for vulnerable servers and, in extreme cases, patch them remotely. "Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell," OpenAI President Greg Brockman said in a statement.