What happened
On October 21, OpenAI announced that, using one of its own artificial intelligence models, it had identified a vulnerability in the open-source programming language PHP. According to the company, the corrected version of the software was made available the same day. The news was reported by ITmedia AI+.
The activity is part of Patch the Planet, the project through which OpenAI supports open-source software security. The U.S. cybersecurity company Calif worked on identifying the flaw, using the GPT-5.6 Sol model. OpenAI says it collaborated with industry partners and the U.S. government, taking two months to prepare the joint publication of the vulnerability and its corresponding fix.
Not just OpenAI: Wiz also found the same bug
The discovery was not exclusive. As reported by the source, the security company Wiz also independently identified the same vulnerability. Wiz said it used Google's Gemini 4 Argon model in addition to GPT-5.6 Sol. This is a company statement, reported in the material, and not an independently verified element.
The most significant point concerns timing: according to OpenAI's account, the flaw was found by artificial intelligence tools before it could be exploited by an attacker. It is therefore a concrete case of the defensive use of AI applied to open-source code, but it does not by itself prove that automated tools are more effective than humans: the material contains no comparative data on traditional research times or methods.
The prediction and the downside
OpenAI stated that discoveries of this kind "will increase rapidly in the coming months." The company is also working on other critical vulnerabilities. At the same time, however, it stressed that the same technology can be used offensively: if advanced tools allow defenders to get ahead of attackers, attackers can in turn exploit similar models.
For this reason, OpenAI announced its intention to continue support through its security program and to contribute to building a framework for vulnerability management that takes AI use into account. These are statements of intent: the material does not specify contents, deadlines, or parties involved in this framework.
What remains to be clarified
Several elements are not specified: the nature and technical severity of the PHP vulnerability, the number of affected versions, the details of the reporting process, and the exact role of each partner. It is not indicated even whether OpenAI contacted the PHP maintainers or whether a coordinated disclosure procedure was followed. The account is based on OpenAI's communication and Wiz's statements, without independent corroboration in the available material.
