OpenAI Found the PHP Bugs. The Two Months After That Matter More.

PHP runs somewhere around seventy percent of the web. This month, OpenAI said its models, including GPT-5.6 Sol, helped researchers find critical security flaws in it. That sentence is the headline. The sentence after it is the actual story: the company then spent two months in a coalition of maintainers and security providers developing and testing fixes before anything went public.

Two months of silence is not a press cycle. It's the part of vulnerability work that nobody gets to screenshot.

Coordinated disclosure is the product

Finding bugs with a model is now cheap. A good agent with a shell, a copy of the source, and a few hours will produce candidate crashes faster than a human reviewer working the same code. Most of them will be garbage, and sorting garbage from a genuine memory-safety issue is where the cost moved.

What OpenAI did here, or at least what it says it did, is the unglamorous middle: form a coalition, verify each candidate, write patches, test them against the ecosystem, agree a disclosure date, and only then publish. That sequence is the reason a PHP flaw didn't turn into a weekend of exploitations against WordPress sites.

It also means the question that matters isn't whether a model found something. It's whether this arrangement can repeat. A coalition works when one well-resourced party convenes it. It doesn't obviously scale to the thousands of open-source projects that sit in the same dependency graph as PHP and have no one to convene anything.

The checker is honest about what it can't do

Alongside the disclosure, OpenAI released a PHP version checker: a Codex skill and a Node CLI tool. Point it at a site and it scans HTTP headers, then reports OK, VULNERABLE, or UNKNOWN.

The method deserves a close read. It compares the version string in the header against known patch cutoffs. It doesn't independently verify anything. That's a deliberate design choice, and it produces a tool with three honest outputs instead of two dishonest ones.

Header-based detection has a known failure mode: plenty of production PHP deployments lie about their version, either because a reverse proxy rewrites the header, because the header is stripped, or because someone set expose_php off years ago and nobody remembers. That's what UNKNOWN is for. A tool that says "I can't tell" is more useful than one that says "you're fine."

The distribution channel is the other interesting detail. This shipped as a Codex skill, not as a web app or a GitHub Action. That's a statement about where OpenAI thinks security triage will happen next: inside the same agent that's already reading your repository.

How a model finds a memory bug

It's worth being precise about the mechanism, because "AI found vulnerabilities" gets used for three different things.

The first is fuzzing with a smarter scheduler. Coverage-guided fuzzers have been finding PHP bugs for a decade; what a model adds is the ability to read a patch, guess which adjacent code path is now reachable, and write the harness that exercises it. That's genuinely useful and entirely unmagical.

The second is reasoning over source. Given a function that parses a length prefix and then allocates, a strong model will flag the integer overflow and propose a candidate input, without running anything. This is where most of the false positives come from, because the model can't see the caller three files away that already bounds the value.

The third is triage. Sorting a few hundred candidates into "probably real," "probably noise," and "needs a human" is the least discussed and probably the highest-value use, because it's the step that determines whether a security team has time to look at anything at all.

Only the third one scales without a coalition. Which is the quiet problem with this whole announcement: the model work is replicable by anyone with an API key, and the coordination work is not.

A billion dollars of access

OpenAI also committed $1 billion in Daybreak access for frontline defenders. Read that as infrastructure rather than charity. Detection tools only help if the people running them can afford to run them at the rate attacks arrive. A free tier gets a hospital's IT team to check once. A billion in committed compute gets them to check continuously.

There's a strategic logic underneath that's worth naming. If model providers become the upstream of security tooling, they also become the party that decides which vulnerabilities get found first, and who gets told. That's a lot of concentrated judgment sitting in a commercial lab, and the disclosure process above is exactly the kind of thing that determines whether the arrangement is trusted.

It's also a recruiting argument. Security researchers are scarce, and a lab that can point to a two-month coordinated fix of the web's most common language has a better story than one that publishes a benchmark.

What this means if you run a site

Check your PHP version this week, and check it from outside your network, since that's what an attacker sees. If the header tells you nothing, you have work to do that no scanner will do for you, because the only reliable answer lives in the package manager on the box.

Then think about the pattern rather than the incident. The model didn't replace the security team. It changed the ratio: more candidates, more triage, same number of people qualified to decide. Every organization that adopts these tools is going to have to build the triage capacity somewhere, and the ones that don't will end up with a backlog of unread findings that looks exactly like not having run the scan.

The part that will be forgotten

One more thing worth noticing: the tooling shipped as a version checker, not a patcher. Nobody handed site owners a one-click fix, because a one-click fix deployed across seventy percent of the web is its own outage. The conservative choice here is the right one, and it's also the one that guarantees a long tail of unpatched installs, which is where the next incident comes from.

In six months, the takeaway from this will be "AI found PHP bugs," which is the least interesting true sentence available. The transferable lesson is duller: the value was in the two months of coordinated work, and the model's contribution was making the first week of that process faster.

That's still a big deal. It's just not the deal the announcement is selling. Security work has always been mostly coordination, and the tools that help most are the ones that make coordination cheaper rather than the ones that make finding louder.