OpenAI Discloses PHP Zero-Day Critical Flaws Found via GPT-5.6 Sol, Open-Sources Scanner and Pledges $1B Defense Fund

Background and the Problem

PHP remains a cornerstone of the global digital economy, powering roughly 70% of websites across the internet (including WordPress, Drupal, and custom enterprise stacks). However, its sprawling, historical C-based codebase poses immense challenges for traditional static analysis and manual fuzzing, leaving subtle memory and logical vulnerabilities undiscovered. When remote code execution (RCE) flaws emerge in runtime interpreters, millions of production deployments face critical compromise. To demonstrate the defensive capability of frontier reasoning systems, cybersecurity research firm Calif deployed GPT-5.6 Sol to audit PHP's core interpreter, alongside parallel discovery by Wiz, coordinating a massive responsible disclosure with OpenAI and the PHP maintainers (@OpenAI, 4.9M views).

Architecture and How It Works

1. Frontier Automated Vulnerability Discovery via GPT-5.6 Sol:

• Outperforms traditional static analyzers that generate high false-positive noise on complex pointer arithmetic;
• Leveraged GPT-5.6 Sol's extended reasoning context to trace execution paths across core parameter validation routines, surfacing severe exploitable edge conditions;

1. Open-Source Auditing Tooling:

• Developed and open-sourced openai/php2shell-checker, an automated Codex skill that executes non-invasive audits against server environments to detect vulnerable runtime configurations;

1. $1B Daybreak Security Subsidy:

• OpenAI committed $1 billion in subsidized Daybreak access, funding white-hat security researchers and foundational open-source maintainers to proactively defend critical global software infrastructure.

Benchmarks and Measured Results

• Threat Mitigation Scope:
• Successfully patched vulnerabilities impacting an estimated 70% of web servers worldwide prior to active weaponization;
• Maintained zero in-the-wild exploitation during the coordinated patching window;
• Auditing Tool Reliability:
• The openai/php2shell-checker achieved a 99.4% true-positive detection rate across enterprise container benchmarks, reducing false alarms by 88% compared to legacy regex scanners;
• Ecosystem Reach:
• The announcement logged 13,600+ likes and 4.9M impressions, highlighting AI-assisted security as an indispensable defensive imperative.

Getting Started for Developers

• Tool Installation & Usage:

  git clone https://github.com/openai/php2shell-checker.git
  cd php2shell-checker && pip install -r requirements.txt
  python checker.py --target https://your-server-domain.com
  

• Operational Action: DevOps and security engineers managing PHP services must upgrade their runtimes to the latest security patch levels and execute automated validation sweeps using php2shell-checker.