openai says ai helped find critical php flaws used on 70% of sites

Felix Laurent 21 Oct 2026 2 min read

big tech

OpenAI says its models helped researchers find critical security flaws in PHP. The company calls PHP an open-source language that runs an estimated 70% of websites. We read the announcement and checked which parts are fact and which are OpenAI's own judgement.

what openai announced

The post makes a handful of claims, and the table lists them with the way OpenAI frames each one. Most of them describe OpenAI's own role.

claim	how openai states it
discovery	models helped researchers in its Patch the Planet initiative find critical flaws in PHP
reach	PHP runs an estimated 70% of websites
preparation	a coalition was led for two months before disclosure
fix	a major change to the PHP engine
status	every PHP site can now upgrade to a safe version

The 70% figure is an estimate, and the post names no source for it.

why the fix took two months

OpenAI says it led a coalition of maintainers, researchers and security providers to prepare fixes and protections before disclosure. It explains that the duration was necessary because the fix was intricate. The fix required a major change to the PHP engine.

The full OpenAI post adds a detail the short post leaves out. PHP's maintainers led the fixes and the release. OpenAI's teams and partners such as Wiz and Cloudflare contributed research, technical support and coordination.

what openai says about severity

OpenAI considers the bug one of the most impactful vulnerabilities in recent memory. It says this marks a new phase, where AI can find security bugs with internet-scale impact. It also says that, to its knowledge, frontier AI found the flaw ahead of attackers, giving defenders time to prepare.

These are the company's judgements. The post gives no technical detail that a reader could use to test them.

what the post leaves unproven

The list below shows what a reader cannot verify from the OpenAI post alone. Each item needs an outside source.

the severity rating, which is OpenAI's own
the claim that AI found the bug before attackers, which OpenAI limits with "to our knowledge"
the 70% share of websites, which is an estimate

Until independent sources confirm these points, they stay attributed to OpenAI.