OpenAI Exposes 22-Year PHP Flaw in 2 Days as Patch Lands for 70% of Websites

Q: Who ultimately decides which open-source projects qualify for OpenAI's new $1 billion security fund to protect critical infrastructure?

OpenAI ultimately decides eligibility, because it is administering the program and has not published an independent selection body or formal rulebook for open-source projects. The material available shows this is not a conventional cash fund with fixed grant criteria. OpenAI describes it as $1 billion in subsidized Daybreak access, training, technical support and partnerships, with open-source maintainers named as one priority group. But the application language is explicit that submitting interest “does not guarantee eligibility, funding, model access, partner services, or a particular timeline.” That means there is no publicly disclosed outside panel, government board or open-source foundation making the final call. OpenAI may consult partners through programs such as Codex for OSS, Patch the Planet, Trail of Bits, or government and infrastructure collaborations, but the final determination appears to remain with OpenAI under internal review. For open-source projects specifically, the clearest practical answer is that maintainers can apply, but the standards for approval, allocation and timing have not been fully published. In effect, OpenAI has reserved discretion over which projects qualify and what support they receive.

3 articles · Updated · CNN · Oct 21

OpenAI said AI found workable exploits for a critical PHP vulnerability in two days, turning a 22-year-old theoretical flaw into an urgent real-world risk before a patch was released Wednesday.
PHP powers about 70% of websites, and the bug could let attackers leak data or execute malicious code by triggering out-of-memory crashes and abusing stale memory states.
Calif found one exploit on Aug. 1 after starting tests July 30, then uncovered more; Wiz later found additional PHP exploits and called the issue one of software history’s most severe.
Cloudflare saw thousands of exploit attempts in the hours before disclosure after an apparent leak, underscoring warnings that publicly available AI tools have sharply lowered the effort needed to weaponize old flaws.
Researchers said the episode shows 'security by exhaustion' no longer works: many legacy bugs may now be practical to exploit, while outdated PHP deployments could remain exposed even after the fix.

Sources

Left75%

Right25%

CNN11d ago

OpenAI AI Exploits 22-Year-Old Critical PHP Vulnerability in Two Days

bbc.co.uk11d ago

Websites taken down as critical PHP cyber-security update issued - BBC News

Wiz11d ago

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog

11 Sources

As AI systems independently discover critical zero-days, how will defenders outpace malicious actors using the exact same technology?

Who ultimately decides which open-source projects qualify for OpenAI's new $1 billion security fund to protect critical infrastructure?

With reports of leaked embargoes, does a coordinated 'Defender's Window' actually protect systems, or just create a false sense of security?

The PHP2Shell Crisis: How AI Uncovered and Helped Patch the Decade-Old Vulnerability Impacting 70% of the Web

Overview

The October 2026 PHP2Shell crisis began when AI-powered audits by Calif and Wiz Research uncovered decade-old memory safety flaws in PHP, leading to a coordinated defense effort with OpenAI, major cloud providers, and the PHP Foundation. After a public leak forced early disclosure, emergency patches and web firewall rules were rapidly deployed, but attackers began exploiting the flaws immediately. Governments advised taking unpatched systems offline, causing service disruptions for critical infrastructure like Dutch government portals. To support defenders, OpenAI committed $1 billion in AI cybersecurity resources, helping organizations like municipal water utilities patch systems without downtime. This event highlights the power of AI in both discovering and defending against large-scale software vulnerabilities.

...