OpenAI Says AI Found PHP2Shell Before Attackers. The Disclosure Timeline Supports Part of That

OpenAI's account of the PHP2Shell disclosure makes one claim that can be tested and one that cannot. The testable claim is that frontier AI found the flaws, CVE-2026-109618 and CVE-2026-109619, before attackers did. The public record supports a narrow version of it: reports to PHP began on Aug. 11, and the first working in-the-wild exploitation anyone has documented came on Oct. 24, three days after the fixes shipped. What the record does not support is a clean story of a secret kept until patch day.

One caveat on sourcing. OpenAI's own post on its "Patch the Planet" initiative returned an access error when this article tried to fetch it, so OpenAI's claims below are as relayed by PPC Land and Decrypt, and are labelled as OpenAI's.

What OpenAI says happened

According to PPC Land's reading of the post, OpenAI says it "led a coalition" of maintainers, researchers and security providers over two months, and that, "to our knowledge," frontier AI found the flaws before attackers did. Calif, a security firm, found one flaw using OpenAI's GPT-5.6 Sol; Wiz independently found and reported both.

Greg Brockman, OpenAI's president, told the same story in the terms Decrypt reports: the bug was "discovered and addressed using our models as part of our Patch the Planet initiative," and "the fixes were quite intricate for PHP." Varonis, which does not work for OpenAI, dates the sequence more precisely: Calif found the bugs on Aug. 1, reported them to PHP on Aug. 11, and credits OpenAI's initiative for Calif's work.

OpenAI's post sets out a five-stage framework: validate and fix, give affected organisations time, coordinate with governments, prepare updates across products, then publish guidance. It names CISA among the government partners. It also lists open questions, including when staged notification beats wide notice and how to weigh that coverage against the risk of a leak.

Where the record pushes back

The leak is the problem. Cloudflare says the flaw leaked before the official release date and that it saw attack traffic aimed at its customers, with attackers changing payloads to evade its rules, per PPC Land. Cloudflare's CTO, Dane Knecht, said the company saw early attacks on both flaws before the patches shipped. Decrypt reports that PHP's maintainers moved the release up by a day because details were leaking. BleepingComputer says Amazon Threat Intelligence spotted attackers targeting the flaws four days before the patches.

Credit is also contested. Cloudflare credits four finders, including Quarkslab, which OpenAI's page does not mention, PPC Land reports. Decrypt adds that a limited version of the bug surfaced in 2024 and that the flaw reportedly sat in PHP for 14 years, which is a reminder that "found first" depends on what counts as the bug.

Date (2026)	Event	Source
Aug. 1	Calif finds the bugs	Varonis
Aug. 11	Calif reports them to PHP	Varonis
Oct. 20	PHP pre-announces a security release	PPC Land, citing CERT-EU
Oct. 21	Fixed PHP versions ship; CISA alert published	CISA, BleepingComputer
Oct. 24	Perplexity's Adel Karimi reports confirmed RCE on a honeypot	BleepingComputer
Oct. 26	CISA adds both CVEs to KEV	CISA

What the strongest counter-case is

The case against "attackers were already exploiting it" is the quality of the pre-patch evidence. Dataminr's TRACE team described activity before Oct. 24 as scanning, fingerprinting and non-working exploits with no known compromises, and BleepingComputer reports that Cloudflare, Hadrian, watchTowr, Previdian and Patchstack saw failed attempts. Marcus Hutchins of Expel called Karimi's honeypot capture the highest-quality confirmation of exploitation he had seen. On that record, working exploitation followed disclosure.

There is a second reading. Failed attempts show that attackers had learned of the bug and were trying, which is not the same as having found it themselves. A claim of "first" is a claim about discovery. A leak of a patch-day secret says something different, and OpenAI's framework itself asks how to weigh coverage against leak risk.

Why the pattern matters beyond PHP

The Brotli decoder flaw, CVE-2026-111497, came out of the same discipline. Node.js credited Khai Tran and Sylvie Mayer of OpenAI's Codex Security, and the fix had been public in google/brotli since Feb. 27 without an advisory, per Help Net Security. CISA listed PHP2Shell five days after the fixed releases and Brotli six days after Node.js disclosed, which makes the timing of AI-found disclosure a story about defenders' patch windows rather than finders' speed. Google has already restricted a model to defenders for similar reasons; see our report on Gemini 4 Carbon and the cyber defenders index.

1. PHP2Shell5 days
2. Brotli CVE-2026-1114976 days

Source: CISA KEV JSON feed and CISA PHP alert (PHP fixes Oct. 21, KEV Oct. 26); The Register and CISA KEV feed (Node.js disclosure Oct. 21, KEV Oct. 27)

What would settle the question is simple to state and hard to get: server logs showing a working exploit against a PHP worker before Oct. 21. Nobody has published one. Until then, the defensible summary is that AI-assisted researchers reported first, the confidentiality window did not hold, and the first documented working exploit arrived three days after the patch. For another case where release integrity was the issue, see our report on the OVHcloud CLI release replacement.