Party
OpenAI (Patch the Planet, Codex Security, Amy Burnett)
reported the same root cause on 11 August; ran the coordination coalition
Claims this site attributes to this party
| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| PHP is used by almost 70% of websites None of the three cites the survey it comes from. A share of websites using PHP is an upper bound on exposure, not a count of vulnerable systems. | Cloudflare; OpenAI ('an estimated 70%'); Wiz body text | reported | 3/3 | Cloudflare OpenAI on X Wiz |
| The flaws were found by researchers using frontier AI under OpenAI's Patch the Planet initiative All three research parties say AI was used. Calif: 'No special harness, or access to models that weren't generally available to everyone were used'. Calif does not name a model; Wiz names Gemini 4 Argon, GPT-5.6 Sol and Wiz Atlas; OpenAI's blog reportedly names GPT-5.6 Sol but is blocked. | BBC; OpenAI; Calif; Wiz | reported | 3/4 | BBC News OpenAI on X Calif Wiz |
| Frontier AI found the flaw ahead of attackers, giving defenders time to prepare Amazon reports an exploit attempt against a honeypot on 17 October, four days before disclosure, from an actor whose source of exploit information is unknown. | OpenAI | disputed | 1/2 | OpenAI on X THN |
Its sources in the vault
- OpenAI on X: OpenAI models helped researchers ... discover critical security flaws in PHP OpenAI (@OpenAI)
- Patch the Planet — OpenAI OpenAI (Patch the Planet / Daybreak)
- OpenAI models help researchers uncover critical PHP security flaws OpenAI Developer Community (user 'sps', Leader)