aiqbench analysis
The story is notable as a test of AI-assisted vulnerability discovery, since OpenAI's Daybreak funding and models from OpenAI and Google are credited with finding flaws in PHP, a language underlying a large share of the web. Readers should weigh the claims carefully: the severity is still debated, and high-profile disclosures often carry some promotional framing, so independent assessment of the exploits and patch adoption matters more than the attribution to specific models. The broader signal is that AI-driven security auditing of widely used open-source code is becoming an operational practice.
[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months

The Big Hardening begins
Almost 2 months ago, OpenAI introduced Daybreak for Frontline Defenders, a $1B subsidy for access to Daybreak cyber models and products. That funding came into use almost immediately, as major vulnerabilities in PHP were independently discovered by two parties: Ryan Austin, a researcher at the security firm Calif, as part of the OpenAI “Patch the Planet” project in August 2026 using GPT 5.6 Sol: 41 Replies · 92 Reposts · 1.14K Likes … as well as Wiz, recently acquired into Google Cloud (using Gemini 4 Argon and GPT-5.6 Sol, as well as their own tool, Wiz Atlas). All high profile cyber disclosures are at least a little bit of marketing, and the degree to which this was a severely alarming vulnerability on the order of famous ones like log4shell and Heartbleed is up to some debate, but surely the coordinated response across the PHP Ecosystem is the developer community responding in its most ideal form. We should expect to be in for at least a year of finding such critical vulnerabilities; but it is the wrong move to blame the messenger for finding them; rather it is good to know that our critical software is generally getting the biggest security…
Excerpt shown under the publisher's RSS terms · 200 words · full text and figures are on the publisher's site
Related coverage
MAStrike: Shapley-Guided Collusive Red-Teaming on Multi-Agent Systems
arXiv · Jun 15, 2026
MAStrike: Shapley-Guided Collusive Red-Teaming on Multi-Agent Systems
arXiv · Jun 12, 2026

Introducing the Anthropic Cyber Mission
Anthropic · Oct 8, 2026

Critical ViewSonic vCast Vulnerabilities Allow Attackers to Gain Full Control Over the Device
Cybersecurity News · Sep 28, 2026