PHP2Shell vulnerability discovery (Patch the Planet)
Vulnerabilities in core PHP, named PHP2Shell, were found by two parties, one a Calif researcher using GPT-5.6 Sol in OpenAI's Patch the Planet project, and disclosed after a two-month coordinated response.
Ryan Austin of the security firm Calif found the flaws in August 2026 using GPT-5.6 Sol, as part of OpenAI's Patch the Planet project. Wiz, now part of Google Cloud, found them independently, using Gemini 4 Argon, GPT-5.6 Sol and its own tool Wiz Atlas. The PHP ecosystem ran a coordinated response. The newsletter says PHP affects about 70% of the web, and it notes that how severe the flaws are, compared with Log4Shell or Heartbleed, is debated.
- Date
- Thursday 22 October 2026
- Lab
- OpenAI
- Kind
- paper
- Access
- paper only
Figures
| Measure | Value | Measured by |
|---|---|---|
| Share of the web running PHP | 70% as stated in the newsletter headline | Latent Space |
Based on a single newsletter page. The discovery dates from August 2026 and the public disclosure date is inferred from the article date. I did not read a primary source from OpenAI, Calif or the PHP project.
Sources
This record was partly confirmed: some claims could not be checked on 22 October 2026. How we check