OpenAI discovers two critical PHP vulnerabilities, allocates $10 billion for Daybreak Initiative

Author: OpenAI Safety Team

Compiled by Deep潮 TechFlow

DeepChao Summary: In its latest Responsible Vulnerability Disclosure report, OpenAI revealed that its internal AI agents proactively discovered two critical underlying vulnerabilities in the open-source programming language PHP, affecting millions of websites worldwide. Collaborating with the PHP maintenance team, Cloudflare, and government security agencies, OpenAI secured a months-long patch window to strengthen defenses prior to public disclosure. The company also announced a $1 billion investment in the Daybreak initiative to support frontline defenders, marking a major breakthrough in the evolution of cutting-edge AI from passive code auditing to active cybersecurity defense.

Over the past two months, we led the formation of an alliance of maintainers, researchers, and security providers to address a critical vulnerability in PHP, an open-source programming language used to power websites and web applications. As part of our Patch the Planet initiative, Calif used GPT‑5.6 Sol to discover a critical vulnerability; Wiz independently discovered and reported both vulnerabilities. PHP maintainers led the patching and release process, while our team, along with partners such as Wiz and Cloudflare, provided research, technical support, and coordination to ensure protective measures were ready prior to public disclosure.

For organizations using PHP, deploying patches is critical. We are providing a PHP version checker tool in the form of Codex skills to help operations teams identify potentially vulnerable PHP versions and determine which updates to apply, in line with guidance from the official PHP team and their service providers.

Given the severity of these vulnerabilities and the widespread use of PHP, we consider this one of the most significant security issues in recent years. This demonstrates AI’s ability to identify security vulnerabilities affecting the entire internet, but the same capability could also enable attackers to rapidly develop attack tools and exploits.

To our knowledge, frontier AI discovered these vulnerabilities before attackers did, giving maintainers and security providers a defender’s window to prepare patches and protections before disclosure.

To help more defenders leverage these capabilities, we have committed to providing $1 billion in Daybreak usage credits through the Daybreak Program for frontline defenders, with a focus on organizations with limited security resources that are responsible for protecting critical services.

Although these vulnerabilities are significant, they represent only a portion of the multiple critical issues we have already identified and are actively addressing. We anticipate that similar discoveries will increase substantially over the coming months. Drawing on the experience accumulated so far, we propose a framework tailored for the AI era to address severe vulnerabilities in widely used software, and we invite the security community to help refine this framework. This framework unites our models, security expertise, and the power of maintainers to transform vulnerability discoveries into protective measures and establish response mechanisms that scale with advancing AI capabilities.

To truly implement the fix, it may require adapting it to older versions, preparing mitigation measures for service providers, and updating systems across numerous organizations. As more vulnerabilities are discovered, a repeatable process can help these teams respond quickly.

Through Patch the Planet, we provided secure professional support and model access to assist in PHP vulnerability response, working with maintainers and research partners to test fixes and develop guidance materials. We also coordinated with infrastructure providers to protect affected systems and engaged with government cybersecurity agencies to help disseminate guidance to critical organizations. These efforts supported maintainer-led responses and helped other defenders prepare.

For certain vulnerabilities, researchers can collaborate directly with software maintainers to investigate the issue and develop a fix. Other vulnerabilities require a broader coordinated response, as they affect numerous products, or distributors and service providers need time to prepare updates and protective measures. If cutting-edge capabilities are not significantly ahead of widely available ones, this window can be extremely tight. In these cases, our framework helps maintainers identify the necessary participants and coordinate related efforts. The response process may include five phases:

• Verify and remediate upstream vulnerabilities. Maintainers, researchers, and necessary technical partners jointly confirm the vulnerability, assess its impact, and develop and test patch solutions. This process includes using state-of-the-art models to conduct adversarial testing, identifying methods to bypass patches and related vulnerability variants.

• Provide affected organizations with time to act. We have established a framework to assess which organizations need advance notice to prepare protective measures; the decision on whom to invite is left to the maintainers. We assist with outreach, manage information-sharing agreements, and coordinate efforts across teams. Distributors may need to adapt patches to older versions, hosting providers may need to test mitigation strategies, and security providers may need to prepare detection or prevention measures, including Web Application Firewall (WAF) rules.

• Coordinated with government partners to help protect critical systems. Government agencies play an indispensable role in coordinating broader responses and conveying security guidance to organizations responsible for critical infrastructure and other essential services. In response to the PHP vulnerability, we collaborated with partners to engage multiple U.S. government departments, including the White House Superintelligence Task Force, the Office of the National Cyber Director (ONCD), the Cybersecurity and Infrastructure Security Agency (CISA), and international partners, to support this effort.

• Prepare updates for each affected product. As remediation plans, guidance materials, and disclosure strategies stabilize, maintainers can invite additional distributors, custodians, other service providers, response teams, and operations personnel to assist in preparing updates and addressing coverage gaps.

• Once the patch is available, publish guidance and support deployment. Public guidance helps individuals assess their own risks, locate updates or temporary mitigations from authoritative sources, and confirm that the fix has been applied. Response efforts continue as operators deploy updates and report areas requiring assistance.

The proposed framework will consider the organization's protective responsibilities, including safeguarding its own systems and customers, the time required to take action, and the ability to handle sensitive information. The same standards will apply to similar organizations, and the maintainers will determine which organizations to invite to participate prior to disclosure.

Each party will receive the information needed to conduct protection efforts, ranging from network logs containing indicators of compromise to more sensitive, actionable proof-of-concept exploit code. Even limited details can expose vulnerabilities, so we weigh the risks of sharing this information against the protective benefits it provides.

Teams following this framework will collaborate with maintainers to provide defenders with adequate preparation time; if a vulnerability is actively exploited, sensitive information is leaked, a public patch exposes the vulnerability, or remediation is stalled, increasing user risk, the timeline will be reassessed.

The Patch the Planet website aggregates publicly disclosed information and guidance materials to help operators identify affected systems, locate appropriate updates, and verify that patched software is functioning correctly. For PHP, the site provides official patches released by maintainers, upgrade instructions, and links to technical research from partners. The guidance also covers temporary mitigation measures, when to involve service providers or experts, and backup and recovery procedures. While temporary protections can reduce risk, we clearly outline their limitations and the operational trade-offs required.

Operations personnel can refer to CISA’s guidance on prioritization and remediation to assess the urgency of actions based on exposure, exploitation status, and potential impact. This may involve patching urgently, implementing immediate mitigations, or scheduling updates as planned; forensic preliminary analysis should also be conducted concurrently when necessary to determine whether the system has been compromised. Priorities should be reassessed as circumstances evolve, and a clear path to permanent remediation should be established.

Global coordination离不开 software maintainers. Many projects are run by small teams who must balance security report reviews alongside their daily development work. These teams need support to distinguish new issues from duplicate reports, assess impact, and test fixes across all still-supported versions. We support this work through funding, access to powerful models, and direct engineering assistance.

The AI capabilities across the industry are continuously improving. We expect AI to play an increasingly vital role in helping defenders identify vulnerabilities, monitor systems, and respond to threats. We are investing in models, tools, and partnerships to empower defenders to put these capabilities into practice.

Our investments include providing subscriptions to all maintainers through Codex for OSS, as well as direct sponsorship of initiatives such as the Rust Foundation to support maintainers and technical work. Each project determines its own priorities. Reusable testing and security workflows help reduce the effort required to address future vulnerability discoveries. Open source projects can apply to Patch the Planet for practical, hands-on support.

We are also training additional classifiers for Daybreak to help reduce abuse risks. This requires difficult trade-offs: security measures designed to prevent abuse may also hinder legitimate security research. Both enabling broader access to powerful models and effectively preventing abuse are crucial. Our goal is to restrict harmful uses while preserving defenders’ ability to discover and fix vulnerabilities. As capabilities continue to evolve and we gain practical experience from how these tools are used, we will continuously adjust to find a better balance.

As model capabilities improve, we have the opportunity to do more than just identify and fix individual vulnerabilities. We aim to help engineers build more secure software from the start. Improving a widely used component can prevent defects—or limit their impact—across numerous products and services.

AI can assist engineers in understanding existing code, preparing modifications, and writing tests, while maintainers and security experts are responsible for verifying that these changes preserve the behaviors users rely on. We have identified several opportunities in the following areas:

• Ensure code security at the source. Programming models help developers choose safer default settings, use security libraries correctly, and identify high-risk patterns while writing code. Preventing vulnerabilities during development means fewer emergency patches for maintainers and users to address.

• Memory-safe software. Migrating critical components to memory-safe languages can eliminate many common categories of memory errors. AI can assist with the migration, followed by testing and expert review to verify behavior and compatibility.

• Formal verification. Mathematical proofs can demonstrate that, under well-defined assumptions, critical components satisfy specified security properties. Applying these methods to widely used components has the potential to eliminate entire classes of vulnerabilities in services and critical infrastructure that rely on them.

• Stronger isolation mechanisms. The system must also defend against undiscovered or unpatched vulnerabilities. Running software that processes untrusted files, images, or media within strictly confined sandboxes can limit damage if the software is compromised. AI can assist engineers in testing and strengthening widely used sandboxing technologies, thereby enhancing protection across numerous applications.

We are making this method public in the hope that maintainers, researchers, response teams, service providers, and operations personnel will collaborate to enhance its feasibility. We seek to understand where it proves effective, where it may cause delays or added burdens, and what aspects we may have overlooked. Real-world examples from previous vulnerability disclosures are especially valuable.

We pay particular attention to the following aspects:

• Disclosure window. How much time do maintainers, operators, and defenders need to prepare and deploy a reliable fix? What evidence should prompt us to disclose earlier, especially when some users can be protected sooner than others?

• Emergency patching. For systems owned or authorized for management by governments or other operators, if administrative access has been lost, should vulnerabilities be exploited to patch them? If so, under what circumstances should this be done, and what safeguards should be implemented? We can envision an ultimate scenario in which the entire internet is continuously scanned for known vulnerabilities; upon detection, website owners are notified or the systems are automatically patched.

• Advance notice. Which parties need to be notified in advance of risks in order to take effective protective actions? Does this include defenders we may have overlooked? In what scenarios is phased notification more effective than notifying a broader group all at once? And how should the scope of coverage be balanced against the risk of leakage?

• Secure-by-default packages. When upstream fixes are not yet available, how can we help identify and fix vulnerabilities in downstream packages, or backport fixes to older versions that no longer receive security updates? What testing and maintenance efforts are required to make these packages reliable options when timely upgrades are not possible?

We also welcome recommendations for independent security experts to help review this approach, challenge its assumptions, and identify gaps. Your feedback will help us refine our response mechanisms and prioritize support efforts. Please share your thoughts here.

• 2026

• Daybreak