Share Coordinating a global response Coordinating a global response Giving maintainers the capacity and resources to respond Building more secure software foundations Help us improve this approach Coordinating a global response Giving maintainers the capacity and resources to respond Building more secure software foundations Help us improve this approach Over the past two months, we led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications. Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet (opens in a new window) initiative, with Wiz also independently discovering and reporting both vulnerabilities. PHP's maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure
For organizations using PHP, the priority now is applying the fixes. We're sharing a PHP version checker as a Codex skill (opens in a new window) to help operators identify potentially vulnerable PHP versions and, alongside PHP's and their providers' guidance, determine which updates apply
Given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory. It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits
