Patch the Planet: global response coordination as agents uncover vulnerabilities
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
PHP shipped emergency patches for two 9.2-severity flaws found with AI help.
PHP powers most websites, so operators worldwide raced to update or go offline.
Background
PHP is a server-side programming language maintained by the PHP Foundation, an organization that leads fixes and releases for the language. Patch the Planet is a joint effort by San Francisco-based AI company OpenAI and security firm Trail of Bits, run inside OpenAI's Daybreak cybersecurity initiative, that pairs AI-assisted bug hunting with expert validation and coordinated disclosure. The root cause traces to a memory-corruption bug flagged during PHP's first external security audit, funded by Germany's Sovereign Tech Agency and carried out by Quarkslab, which sat unresolved for roughly two years before a working exploit path was found.
How it unfolded
- 2024A memory-corruption bug tied to how PHP handles requests hitting its memory limit was first flagged during PHP's first external security audit, funded by Germany's Sovereign Tech Agency and carried out by Quarkslab. No working exploit was found and the issue sat unresolved for roughly two years.
- Jun 22, 2026Patch the Planet was announced as a joint effort involving OpenAI and Trail of Bits within OpenAI's Daybreak cybersecurity initiative.
- Aug 11, 2026A researcher at Calif, a California-based AI red-teaming firm, reported an unconditional remote-code-execution path tracing back to the 2024 root cause. OpenAI says it independently reported the identical issue the same day, and the PHP Foundation confirms both flagged the same flaw, with Wiz contributing further attack vectors shortly after.
- Oct 21, 2026PHP shipped emergency patches for CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS severity scale and collectively called "php2shell", and the PHP Foundation released fixes with update instructions.
- Oct 21, 2026As reports broke overnight ahead of the official release, some opportunistic attackers tried to exploit the flaws; Cloudflare began seeing "early attacks," according to CTO Dane Knecht.
- Oct 21, 2026Governments and organizations in Europe and the U.S. took websites offline temporarily; the Finnish government's website was only partly available Wednesday. The program dashboard showed 68 codebases under review, 1,995 issues found, 679 patches written and 466 patches accepted upstream.
Who’s saying what
- Official
- OpenAI called the flaws "one of the most impactful security issues in recent memory," said AI appeared to find them before any attackers did, and expects similar findings to increase sharply in the coming months.
- Official
- The FBI cyber division warned the vulnerabilities could allow malicious actors to remotely execute code in PHP and recommended operators take websites offline if they can't update immediately.
- Analysts
- Ismael Valenzuela of Arctic Wolf said "the potential impact is enormous," noting PHP powers roughly 70% of websites where the server-side language is known.
- Caution
- Raghu Nandakumara of Illumio described a paradox: wanting AI to move fast enough to find bugs humans miss while keeping increasingly autonomous systems within boundaries we understand and control.
- Party
- Trail of Bits said the program is meant to help maintainers cope with machine-speed vulnerability discovery by supplying expert validation, patches and workflow improvements.
Still unverified
The program dashboard figures (68 codebases under review, 1,995 issues found, 679 patches written, 466 patches accepted upstream) were program-reported and not described as independently audited. One startup owner claimed hackers stole their source code, exposed cookie data and leaked legal documents via the PHP bug, saying the flaw is "real bad" and everyone should be "afraid"; instances of successful breaches were described as still limited and unfolding.