OpenAI proposes five-stage coordinated disclosure as AI finds critical PHP flaws
OpenAI announced on October 21, 2026 a proposed five-stage framework for coordinating responses to critical vulnerabilities in widely used software, built on its Patch the Planet initiative, after frontier AI models found critical flaws in PHP before attackers did.
Over the past two months, OpenAI says it led a coalition of maintainers, researchers and security providers on the PHP response: the security firm Calif identified a critical flaw using GPT-5.6 Sol, and Wiz independently discovered and reported both vulnerabilities. PHP's maintainers led the fixes and release, with Cloudflare and others contributing research and protections ahead of disclosure.
The five proposed stages: validate and fix the upstream vulnerability with adversarial testing; give affected organizations time to act while maintainers decide whom to involve; coordinate with government partners to protect critical systems; prepare updates across affected products; and publish guidance supporting deployment once a patch is available.
OpenAI says it engaged multiple parts of the U.S. government on the PHP case, including the White House Super Intelligence Force, the Office of the National Cyber Director and CISA, plus international partners. It is sharing a PHP version checker as a Codex skill so operators can identify vulnerable versions.
The company frames the episode as opening a 'Defender's Window' - frontier AI finding flaws before attackers - but warns the same capabilities can speed offensive tooling, and says similar findings will increase sharply. It is funding maintainers through Codex for OSS subscriptions and direct sponsorship such as the Rust Foundation.
For security and platform teams, the near-term action is patching PHP and tracking the Patch the Planet site for authoritative guidance; the framework itself is a proposal OpenAI is asking the security community to improve, so treat its governance shape as unsettled.