The PHP2Shell case and the role of the model
OpenAI has announced that the critical vulnerability in the PHP language known as PHP2Shell was identified with the help of its GPT-5.6 Sol model. The discovery is attributed to cybersecurity company Calif, which, according to the source, used the model to identify and disclose the flaw, classified under two CVE identifiers: CVE-2026-109618 and CVE-2026-109619. The PHP development team released a corrective patch at 23:00 on October 21, Japan time.
The same announcement states that Wiz Research also independently found and reported the vulnerability. The double discovery is not described as cross-confirmation by the parties involved, but indicates that the issue was reported multiple times. OpenAI links the case to the Patch the Planet initiative, launched in June to use artificial intelligence to identify and promptly fix flaws in open-source software, with the stated goal of strengthening cyber defenses.
The priority of the patch and the checker
OpenAI identifies applying the patch as the highest priority. To facilitate the operation, the company has published a PHP Version Checker as a Codex skill, a tool that allows operations managers to determine whether the PHP version in use is among those potentially vulnerable and to assess necessary updates, also based on guidance from the PHP project and the vendors involved.
The operational message is therefore twofold: on the one hand, identify exposed software; on the other, decide on intervention with the information provided by developers and by the parties managing installations. The source does not specify which versions are affected, the number of systems involved, or any exploitation already observed.
The claimed defensive advantage and the limits of the announcement
OpenAI highlights an aspect it considers relevant: to the best of its knowledge, a frontier model identified the vulnerability before attackers did. According to the company, this would have given defenders a window of time to prepare fixes and countermeasures before the flaw could be exploited.
The company also announces its intention to continue supporting the identification of vulnerabilities through frontier models and calls for collaboration to improve this type of approach. The release also cites a commitment to allocate one billion dollars in grants for access to Daybreak through Daybreak for Frontline Defenders.
Some elements remain to be verified: the source reports OpenAI's account and the statements on the model's use, but does not offer technical details on the nature of the flaw or on the timeline of disclosure. It does not indicate whether the checker is already available to all Codex users or in what way. In the absence of this data, the announcement should be read as the company's position on the defensive use of AI rather than as an independent assessment of the operation's effectiveness.
