--- title: "How Did AI Find the PHP Vulnerability in OpenAI's Patch the Planet?" url: "https://goremy.ai/blog/articles/how-ai-found-php-vulnerability-patch-the-planet" author: Luis Chavez-Mattos editor: Luis Chavez-Mattos editor_title: Director, Product published: "2026-10-22T21:40:06.627Z" updated: "2026-10-22T21:40:10.806Z" topic: AI Safety & Security description: How Calif researchers used OpenAI and Gemini models plus a reusable skill file to turn a PHP out-of-memory bug into WordPress RCE, and what it means. --- # How Did AI Find the PHP Vulnerability in OpenAI's Patch the Planet? > How Calif researchers used OpenAI and Gemini models plus a reusable skill file to turn a PHP out-of-memory bug into WordPress RCE, and what it means. Edited by Luis Chavez-Mattos, Director, Product ยท Published 2026-10-22 ## How did AI help find the PHP vulnerability? Researchers at the security firm Calif (calif.io), working under OpenAI's Patch the Planet initiative, used an OpenAI model and some Gemini models to probe how PHP behaves when it runs out of memory. They found "interruption points" in the cleanup path that let them chain a remote code execution attack against WordPress. After the first success, they had the model distill the method into a reusable skill.md file, so later searches started from what the earlier ones had learned. ## TL;DR - Calif's work ran under **OpenAI's Patch the Planet initiative**, which exists to fix critical bugs before attackers find them. - The bug class involves **PHP's out-of-memory handling**. The researchers found a first fatal out-of-memory case and the first of three interruption points, which they assembled into WordPress RCE. - A researcher named Austin asked the model to **generalize the technique into a skill.md**, a reusable set of instructions for hunting similar issues. - The NSA and Japan's government both urged organizations to **patch two critical PHP vulnerabilities or take systems offline** if patching was not possible. - The coverage I reviewed does **not verify a day-by-day timeline** or details of any earlier audit, so treat figures like "48 hours" with caution. - The bigger signal is that **AI amplifies a skilled researcher's reach** rather than replacing the researcher. ## What is Patch the Planet? Patch the Planet is an OpenAI initiative. The idea is to use AI models that are good at finding vulnerabilities to patch as many critical issues as possible before attackers get to them. One commentator pairs it with Project Glasswing, a program whose members have access to Mythos, and describes the companies and governments inside it as much safer than those outside. Both programs share a premise: once models can find bugs at scale, defenders need a head start. According to the coverage, Calif joined the initiative on July 30, 2026, and then turned its attention to PHP. PHP is commonly cited as running roughly 70% of websites, and it sits underneath WordPress, which hosts an enormous share of content sites. That reach is why a single flaw there draws government attention. ## What was the PHP bug? The research centered on what happens when PHP runs out of memory. When that occurs, the engine hits a fatal condition and has to clean up. Cleanup code runs while the program is in an unusual state, and that is where the weakness lived. Calif described surfacing "the first out-of-memory fatal and the first of the three interruption points" that let them piece together remote code execution against WordPress. In plain terms, they found places where execution could be interrupted partway through an operation. If an attacker can trigger the interruption at the right moment, internal state can be left inconsistent, and inconsistent state is often something an exploit can build on. I don't have the technical write-up in front of me, so I won't describe the exact memory layout or the exploit chain. The public description supports the shape of the bug, not its mechanics. ## How did the skill.md generalize the technique? After the team landed the first working example, researcher Austin asked ChatGPT to take what they had done and write it up as a skill.md. That is a file of reusable instructions an agent can load before starting a task. Here it encoded how to search for similar interruption-related problems. This works like a loop: 1. A human and a model find one real instance of the bug class. 2. The model writes down the pattern as a skill. 3. The skill guides the next search, which turns up more instances. 4. Each new finding refines the skill. The creator who covered this compared it to Andrej Karpathy's autoresearch idea, where an AI tests changes in a loop and keeps what improves results. The comparison is loose, but the mechanism is similar. A model can take a researcher's accumulated knowledge and explore many paths in parallel, where a person would work through them one at a time. ## What do we know about the timeline? Less than the headlines imply. The sources I reviewed confirm the July 30 start of Calif's participation and a public response that, by the time of coverage, included government advisories and reports of early attack activity. They do not give a verified sequence from discovery to exploit to disclosure, and they say nothing I can confirm about an earlier audit of PHP that missed the flaw. Claims you may see elsewhere, such as an exploit chain built in 48 hours, a disclosure window ending in October, or a lengthy 2024 audit that overlooked the bug, are not established by this material. If you cite them, check Calif's own write-up first. One creator says Calif has an epic-looking write-up of everything that happened, and that the company also made a comic book out of it, so that write-up is the place to confirm dates. One more caveat. The coverage said the details may have leaked before patches were ready, and that Cloudflare was seeing early attacks. The creator flagged this as unverified and developing. Treat it the same way. ## How have governments responded? The response was unusually direct. | Source | Reported message | |---|---| | NSA cyber account | Organizations using PHP should prepare for an update addressing two critical vulnerabilities. If an immediate update is not feasible, take the system offline until mitigated. | | Japan's Prime Minister | Urged action regarding PHP and said suspending websites can be an effective way to reduce risk if patching is hard. | | Dutch and other EU bodies | Reported to have shut down some services, though one commentator admitted to exaggerating the scale. | The NSA noted that flaws like these often give a direct path to the server's file system or database. For WordPress, the concern is code execution without logging in. ## Why does this say something about AI cyber capability? Three points hold up from the material. **AI compresses the search.** The expensive part of vulnerability research is exploring branches. A model that has learned a technique can try many variations quickly. **Skills make progress cumulative.** The skill.md step turned one finding into a tool. That matters more than any single bug, because it means the process improves as it runs. **Gated access is a temporary advantage.** One commentator argued that organizations inside programs like Glasswing and Patch the Planet are safer than those outside. The same commentator claimed that downloadable models such as GLM 5.3 and MiniMax M3.1 Flash can already run attack suites that gated models were meant to defend against six months earlier. I could not verify that claim, but if even partly true, the defensive head start is short. The humans still matter. The model did not wake up and attack PHP. Researchers chose the target, recognized the first real interruption point, and decided to capture the method. ## What should site owners do now? The advice across both sources is consistent and fairly ordinary: - Apply the PHP update as soon as it is available for your version, then confirm the fix is actually running. - If you cannot patch quickly, follow the NSA guidance and consider taking the system offline. - Reduce attack surface. Retire unused sites, APIs, and logins, and avoid storing credentials or customer records you do not need. - Consider OAuth sign-in through a large provider instead of holding passwords yourself. - Use an authenticator app or hardware key for multi-factor authentication, not SMS. - Use unique passwords per account. Unmaintained sites are the main worry. A forgotten WordPress install with no one watching for updates is exactly the target an automated scanner finds first. ## Frequently Asked Questions ### Did AI find the PHP vulnerability by itself? No. Calif researchers directed the work, using an OpenAI model and some Gemini models. They found the first working instance with the model's help, then had the model generalize the method into a skill file. The model amplified the researchers rather than acting autonomously. ### What is a skill.md file? It is a text file of reusable instructions an AI agent can load before a task. In this case it captured how the team found and chained the out-of-memory interruption points, so later searches for similar bugs started from that knowledge. ### Was the exploit really built in two days? The material I reviewed does not confirm that. It confirms Calif joined Patch the Planet on July 30, 2026 and then worked on PHP, but it gives no verified day-by-day timeline. Check Calif's own write-up for dates. ### Is every PHP site affected? The advisories describe two critical vulnerabilities and urge patching or taking systems offline. Exploitability can depend on conditions, and one commentator said code execution without logging in was possible "under the right conditions." Check the official PHP release notes for your version. ### Why does Project Glasswing matter here? Glasswing is Anthropic's program giving selected partners access to its Mythos model for defense. Together with Patch the Planet, it shows the major labs are trying to put strong cyber-capable models in defenders' hands first. How long that lead lasts is an open question.