# Fact: The flaws were found by researchers using frontier AI under OpenAI's Patch the P

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

The flaws were found by researchers using frontier AI under OpenAI's Patch the Planet initiative Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · discovery · reported

# The flaws were found by researchers using frontier AI under OpenAI's Patch the Planet initiative

**Who says it:** BBC; OpenAI; Calif; Wiz · **Sources:** [BBC News](../../sources/bbc-live-ckgel5xp2xv9t/index.html) [OpenAI on X](../../sources/x-openai-php2shell/index.html) [Calif](../../sources/calif-php2shell/index.html) [Wiz](../../sources/wiz-blog-php2shell/index.html)

All three research parties say AI was used. Calif: 'No special harness, or access to models that weren't generally available to everyone were used'. Calif does not name a model; Wiz names Gemini 4 Argon, GPT-5.6 Sol and Wiz Atlas; OpenAI's blog reportedly names GPT-5.6 Sol but is blocked.

## Fact-check

**A3** Echoed●●●○○○ opinion measures differently · Opinion · verdict: **holds in part**

That AI was used is said by each research party in its own capture (Calif, Wiz, OpenAI), but 'found by researchers using frontier AI under Patch the Planet' is a reading: Calif is the only finder shown to be under Patch the Planet, Calif never says 'frontier' and stresses generally available models, and Wiz never mentions Patch the Planet. Readings cap at A3.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [calif-php2shell](../../sources/calif-php2shell/index.html) | partial | *OpenAI invited us to join its Patch the Planet initiative, and PHP stood out as a high-impact target.* | 23afef81971778f9 |
| [wiz-blog-php2shell](../../sources/wiz-blog-php2shell/index.html) | partial | *we explain how frontier AI helped us find and fix vulnerabilities that had remained hidden in the PHP codebase* | e3568b6f88c93f6b |
| [x-openai-php2shell](../../sources/x-openai-php2shell/index.html) | carries | *Patch the Planet: global response coordination as agents uncover critical vulnerabilities* | 785b7cae55e3748b |
| [bbc-live-ckgel5xp2xv9t](../../sources/bbc-live-ckgel5xp2xv9t/index.html) | partial | *The vulnerabilities were found by researchers at the security firms Calif and Wiz.* | c88b8c5f4c6bc07d |
| [php-foundation-blog-security-release](../../sources/php-foundation-blog-security-release/index.html) | partial | *While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem* | a1be057adc1c5bfa |

Open tickets: [Finding-1](../../factcheck/index.html#Finding-1), [Finding-59](../../factcheck/index.html#Finding-59).

Graded in Run-1, resting on captures up to 2026-10-22 08:16 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21Calif publishes [php2shell by Calif Research — A tale of two PHP remote vulnerabilities](../../sources/calif-php2shell/index.html)
- 2026-10-21Wiz publishes [PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet](../../sources/wiz-blog-php2shell/index.html)
- 2026-10-21 14:04 UTCOpenAI on X publishes [OpenAI on X: OpenAI models helped researchers ... discover critical security flaws in PHP](../../sources/x-openai-php2shell/index.html)
- 2026-10-22 06:16 UTCBBC News publishes [PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live](../../sources/bbc-live-ckgel5xp2xv9t/index.html)
- 2026-10-22 08:04 UTCSaved into the evidence vault: BBC News, then 2 more captures
- 2026-10-22 08:10 UTCSaved into the evidence vault: Calif
- 2026-10-22 08:10 UTCSaved into the evidence vault: Wiz
- 2026-10-22 08:16 UTCSaved into the evidence vault: OpenAI on X
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
RRowanJournalistAAshSecurity researcherBBlakeAnalyst or policy advisorRRileyCommunications team
And on [every claim](../../claims/index.html#ai-found).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
```
The flaws were found by researchers using frontier AI under OpenAI's Patch the Planet initiative
Who says it: BBC; OpenAI; Calif; Wiz
Status: reported
Topic: discovery
Sources: bbc-live-ckgel5xp2xv9t, x-openai-php2shell, calif-php2shell, wiz-blog-php2shell
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/ai-found/index.html