OpenAI's Project Daybreak Identifies Critical PHP2Shell Vulnerabilities Affecting 70% of Websites

The discovery of critical vulnerabilities in PHP, which powers 70% of websites, poses a significant risk to global web security.

• OpenAI's Project Daybreak enabled the identification of PHP2Shell remote code execution vulnerabilities on October 21, 2026.
• Key participants included OpenAI, security firm Calif, and the PHP Foundation, who collaborated to prepare patches before public disclosure.
• Patches were released for multiple PHP versions, addressing vulnerabilities that had existed for over 14 years.

• PHP's prevalence: Approximately 70% of websites are built on PHP, making vulnerabilities in this language a widespread concern.
• AI's role: The rapid advancement of AI in cybersecurity has shifted the landscape, allowing for more effective vulnerability detection and remediation.
• Urgency for action: Following the discovery, government agencies urged immediate patching to prevent exploitation, highlighting the critical nature of these vulnerabilities.

OpenAI's Project Daybreak, launched in response to rising threats from AI-driven attacks, has fundamentally changed how vulnerabilities in widely-used programming languages like PHP are discovered and addressed. The initiative provided vetted partners access to advanced AI models, including GPT-5.6 Sol, which were instrumental in identifying critical flaws in PHP.

The PHP2Shell vulnerabilities, which allowed unauthenticated remote code execution, had been present for over 14 years, raising alarms about the security of countless websites. The urgency of the situation was underscored by previous incidents of AI-assisted attacks reported in September 2026, prompting OpenAI to act swiftly.

In July 2026, the security firm Calif began auditing PHP under the Patch the Planet program. By August 11, they reported a significant vulnerability using the AI model. This was followed by independent discoveries from Wiz and additional findings from OpenAI's team. Over two months, these organizations collaborated closely with PHP maintainers and other stakeholders to validate their findings and develop necessary patches.

The patches released on October 21, 2026, addressed vulnerabilities in multiple PHP versions, including 8.5.12 and 8.4.27. The coordinated effort ensured that fixes were ready before public disclosure, minimizing the risk of exploitation. Despite the potential for widespread damage, no significant exploitation was observed post-disclosure, indicating that the proactive measures taken were effective.

The aftermath saw government agencies like the FBI and GCHQ urging immediate action to patch affected systems. Some European governments even temporarily took down websites to mitigate risks. OpenAI's commitment of $1 billion in subsidized access to Project Daybreak for under-resourced defenders reflects a growing recognition of the need for robust cybersecurity measures in an increasingly digital world.

• Web developers: Need to implement patches immediately to secure their applications.
• Business owners: Risk losing customer trust and facing potential data breaches if vulnerabilities are not addressed.
• Government agencies: Must ensure public sector websites are secure to protect sensitive information.
• Cybersecurity professionals: Will need to adapt to new AI tools and methodologies for vulnerability management.

• Adoption of AI in cybersecurity: Monitor how organizations integrate AI tools for vulnerability detection and remediation, as this could redefine security protocols.
• Response from PHP community: Watch for updates from the PHP Foundation regarding ongoing security measures and community engagement in vulnerability management.
• Legislative changes: Keep an eye on potential regulations or guidelines that may emerge in response to the vulnerabilities discovered, particularly regarding web security standards.