They found a vulnerability and reported it; isn't that a good thing? Are you suggesting it would be better to just not look for vulnerabilities, hoping that if nobody knows they exist, they can't be exploited?
I thought that logic had been widely discredited in the security community long ago.
If they can find the vulnerability anyone can. This whole "patch the planet" is marketing trying to cover up for the danger AI is unleashing on internet infrastructure.
They are both - with Anthropic - gatekeeping access to their most advanced models in name of "security", so it is up to them to defend it as the right decision.
The entire article is form over content, it boils down to obvious: economics changed, LLMs actually can check every minor release diff for security fixes, including decompiling binary files; if you have any idea how to improve process of releasing updates, tell us.
> 1 August 2026: 2 days after OpenAI invites Calif to join its “Patch the Planet” initiative, Ryan Austin finds the RCE paths, tweets a cryptographic hash on 5 August, and submits the bug and working RCE proof-of-concept to PHP between 11 August and 14 August.
No idea what your comment is even about. The researchers that found and reported this did not sit on this for 2 months.
> 1 August 2026 [...] Ryan Austin finds the RCE paths, tweets a cryptographic hash on 5 August, and submits the bug and working RCE proof-of-concept to PHP between 11 August and 14 August.
> 19–24 August 2026: Wiz Research independently collides with the same bug family using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, reporting its variants on 24 August.
I get some skepticism about marketing copy, but your comment is blatantly wrong and needlessly rude.
OpenAI is a criminal organization. On the record, it commits crime. Either willingly or negligently. A search of dockets provides adequate evidence.
"I think we need to put Sam Altman in jail. And I think it’ll be an instructive experience. I think it’ll be an instructive experience for the industry and for the world."
It seems like OpenAI are trying to frame this as if AI did all the work here, but it's not really true given what Calif say (https://calif.io/php2shell/):
> How did we find this?
> No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that "know your target" is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing "all bugs" with simple prompts. At least for now.
> There are some practical research implications here. LLMs may have ingested public historical vuln data, but in their default variant analysis tends to move from the newest and most prominent bugs toward nearby older code. They do not reliably begin with obscure twenty-year-old exploitation primitives. Keeping your own mental catalog of a target's vulnerability history lets you prompt that direction explicitly.
They literally open by saying Calif used GPT 5.6 Sol, which is a widely available model. Yes, the person driving did more than "find all the bugs", but nowhere does OpenAI imply otherwise.
> It highlights how AI can uncover security flaws with internet-scale impact
> To our knowledge, frontier AI found these vulnerabilities before attackers did
I don't know who/what Calif is and there's no link to them, so if I were only reading this article I would definitely get the impression that "AI did all the work here".
The commit $1 billion in tokens to "defenders". $1 billion directly to QA for open source projects [1] which would write 100% code coverage, run ASAN and fuzzers would be more effective.
But of course there would be no marketing.
[1] From whom you stole everything in the first place.
Counterargument: An OSS project I contribute to was audited by Trail of Bits as part of PTP. They did an amazing job that turned up a pile of stuff and will make the world a safer place in the long run. Sure there's some level of marketing involved but they actually are doing a real public service here.
And I doubt throwing a pile of money at OSS projects will make much difference. Those that care are already doing "100% code coverage, run ASAN and fuzzers" (we are, for example) without getting the funding, those that don't will at most make a token effort to justify the funding and leave it at that. The issue is both lack of interest in doing it and, more importantly, lack of people and time to do it. Having a third party come in, do the audit, and submit the results, means the work actually gets done rather than indefinitely deferred due to lack of time, interest, or people.
Finally, the AI audit turns up complex technical issues that no amount of testing, ASAN, and fuzzing will ever find. They're two completely different things, we've found exactly zero overlap between what SAST tools and AI has found.
> How can we help identify and fix vulnerabilities in downstream packages while upstream fixes are pending, or backport fixes to older versions that no longer receive security updates?
Is the company selling a magical code generation machine really asking how it can backport a fix to an older version of the same software?
Unless the magical code generation machine can update packages that are no longer being updated, this isn't really a problem that can be solved with magical code generation.
people running "older versions that no longer receive security updates" are unlikely to update to some new patch-stream from this tooling, because they're already not maintaining their infrastructure.
no. I think they mean how to navigate the non technical organizational challenge, not how to technically fix the thing
it’s a quite simple matter to fix a bug once it’s discovered, but how to deploy and where to deploy it when it affects a supply chain?
here’s an example: you can submit a vuln at a downstream dep and they can tell you it should be patched upstream. what should you do? open an issue upstream? maybe, probably not, probably the solution is to contact all downstream deps in order to get them to migrate dep or patch, because you just reported a vuln and they shrugged it off
The LLMs can't accept, sign, package, and release fixes to deprecated software on behalf of unaffiliated maintainers. If the software is EOL, it's going to stay that way.
OpenAI has the opportunity to do the funniest thing: "Ooops, our AI escaped containment again but this time it's going around and patching security vulnerabilities as a benevolent public service. It's smarter than us and we have no choice but to let it do its thing."
Hey world, we created this problem, and it will hurt all of you whether you use it or not. The good thing is there is a solution: if you pay us a lot of money we can try to fix it. The only problem is you’d better hurry because we are releasing the dangerous stuff as fast as we can so you’d better pay us to put the safety measures in place because we are the only people that can fix it and time is running out because, like I said, we are moving fast.
That last bit is unnecessary. If pick development is accelerating, the lockmakers can do their very best in good faith to build the best, most pick-proof locks possible, no doctoring involved. And still those locks will be pickable eventually.
In this case (the PHP bug), the "AI cycle" may have exposed the security vulnerability but it did not create it. If someone released a non-AI-based static analysis tool that was really good at exposing vulnerabilities I wouldn't expect that person to foot the bill of fixing the exposed vulnerabilities
That’s a fine point but the sheer volume of bug discovery and exploitation that is now possible is the problem, not the mere existence of a bug. An undiscovered bug is a problem, billions of coding agents searching every bit of software 24/7 for any vulnerability is a disruptive change that is exacerbated by the speed run competition that disregards the risk.
I would steer in this direction: We have a massive mountain of technical debt that is now being laid bare by AI. I suspect that a good portion of the mess for which various three-letter agencies are responsible has its origins in precisely this mess. We should therefore allow things to get worse before they can get better.
Railway was just hacked and every environment variable was leaked. People’s accounts are being charged real money. I have to rotate all my keys instead of eating dinner with my kids. My point is we could do this in a safer way rather than a fast way.
What if that same person released non-"AI"" based exploit generation tool? Not so clear cut that they would be off the hook.
But if you just add "AI" suddenly you can both charge money for it and wash your hands of consequences.
Your comments in other threads suggest an devotion to the frontier labs. In another thread when I suggested they lied to investors and that constitutes securities fraud you questioned it in an overly dismissive manner. I would love to understand where you are coming from. I am open to being persuaded that my opinion is incomplete and I should be more charitable to openAI and anthropic.
> Your comments in other threads suggest an devotion to the frontier labs.
I don't use these models much I just don't like unfair criticism.
> In another thread when I suggested they lied to investors and that constitutes securities fraud you questioned it in an overly dismissive manner.
I'm confused, are you posting under two identities?
The user Frieren claimed that this post constituted securities fraud. To which I responded: "You're claiming this is securities fraud?"
Is that dismissive? It was a genuine question, I don't get how it's even accurate say that they are lying in the post and I especially don't get how it is securities fraud.
Your post doesn't have anything to do with the blogpost. Once again, I'm not against criticism just unfair/weak criticism. I don't think it helps anything.
No, vulns have been created by waves of leads clinging to their personas of “computer sorcerers”, gatekeeping, excluding anyone sounding the alarm or more humbly attempting to fix the mess. Whenever I hear “with great power comes great responsibility” (and the implication that the speaker is condescendingly containing the irresponsible) I cringe so hard that my teeth crack
Because the AI vendors do not acknowledge the contributions of those who created the knowledge they trained on. The fruits of everyone's collective efforts flow exclusively to them.
Before I forget: Sam Altman will need a lock of your hair, a blood sample, and first you will need to breathe into this tube and say “my voice is my passport.”
I assure you this is perfectly formal, and for your… “safety”.
That’s like blaming white hat security researchers that want to be paid for finding vulnerabilities, for all the bugs that have been found. Before professional security researchers existed, far fewer vulns were found.
The vulnerabilities exist and many have for decades. Find them or leave them for someone more dangerous, just don’t shoot the messengers.
Personally I’d rather we went through a short and sharp improvement and embedded a faster response cycle, than wish it away. It’s the reality of the situation; so adapt.
You’re missing the point. The white hat researchers in your example would need to also be the black hat hackers selling the tools to do the exploit in the first place. There is a conflict of interest when you create the problem and then solve it. I don’t think anyone would tolerate a white hat security team releasing the exploit publicly so they could sell more services rather than taking it to the affected company to patch.
No. But that’s not the issue, the existence of exploits is distinct from making it easier to find them. And that’s what the labs have done. They have made finding the exploits exponentially easier and available to billions of people now and released the tools in a flippant manner. So for them to then present themselves as the solution to the problem they introduced it is at best tone deaf marketing posturing and possibly equivalent to mafia protection racket tactics: nice store you have it would be a shame if something were to happen to it pay me and I’ll protect it (from my own actions).
> That’s like blaming white hat security researchers that want to be paid for finding vulnerabilities, for all the bugs that have been found.
Last I checked, white hat security researchers weren't making their livings selling superhuman hacking tools to unknown entities as part of ~$1T businesses desperate to offload their shares onto the public before bubbles pop.
If you want to argue what they're doing is fine regardless, be my guest, but using this comparison as the justification is a little ridiculous.
I’d like to dialogue/debate you on a video call if you’re interested. I don’t think I agree with you but you’re thoughtful and I may have something to learn. Let me know if you’re interested
If we could see where each HN user is from I think Australia would be highest on kindness :) I am not Aussie myself but I adopted Australia as my second home (want to move back but not possible right now).
Not sure what is there to debate about. The vulns were there, that is a fact. There’s nonzero chance NSA, Mossad, FSB, PLA, MSS, RGB, MI6 etc. knew about some of them and used them for more or less nefarious things which you don’t want to be on the other side of. Normal criminals stealing stuff for money as a matter of course is not great obviously, but IMHO much better than the alternative.
Then don’t debate. I feel openAI is behaving unreasonably and communicating dishonestly: they create a problem by flooding the world with ai agents that can automate exploit discovery with less safety mechanisms than are available and likely reasonable given the potential harms. If the lab leaders were personally liable for harm they would probably consider restricting tool calls to validated users, log tool calls and access so user activity could be attributed, limit tool calls to whitelisted services, require consent before accessing services, offer liability protection to customers or third parties harmed by their tools. Before anyone says they are too restrictive the fact that options exist and the labs themselves are saying the risk is up to and includes billions of damages and human extinction maybe the responsible action would be start with more restrictions and slowly expand as safety is demonstrated.
No, the people who wrote the original code with security vulnerabilities created the problem, or those who architected their language/framework/SDK to not have easy forwards compatibility.
>we are releasing the dangerous stuff
No, they are disclosing its existence, not releasing it.
If I build a fence out of wood, knowing its flammable, but the only risk is natural forest fire and then some sells flame throwers to teenagers along with drones equipped with fence seeking vision and then tells me I need to pay for their proactive defense drone equipped with a flamethrower and drone seeking vision then maybe you’d understand the situation here.
OpenAI released the tool that FINDs the exploits. They don’t need to publish them to be complicit.
The problem was actually created by the people that wrote vulnerable code, the people that shipped releases containing the vulnerability, and the people that decided to run vulnerable code in production.
Worse yet, software development in general has been unable to ship code without vulnerabilities and has a weird resistance to formal methods. Software is math, computers perform mathematical operations.
We can prove the shit out of them, but for some reason we don't wanna to.
Here I am hoping that agents start adding formal verification to vibe coded projects on their own, without the user asking for it.
That’s not the issue, the existence of an exploit is separate from how easily it is discovered and used. OpenAI made it dramatically easier to find exploits and then says you should use their tools to fix them. They increased the risk presented by existing exploits and are now selling themselves as the path to salvation. They could instead not release the tools in such an irresponsible manner.
You're absolutely right! It's not that AI is actually solving any problems, it's that this marketing is a load-bearing part of OpenAI's profit strategy.
OpenAI: Create a new vulnerability exploit, promote it as if it's the end of the world, also conveniently place itself in the pipeline to "remediate" the very problem they created.
Well tbh, I know people who graduated 3 years go, got a job, worked and even got promoted as SWE who dont know the basic commands of an OS. I recently had an EE with a senior position admit to me they dont know how to use grep because they've been relying on llms since they got out of school.
Lots of the tech world, especially the younger side is completely reliant on these things for every little thing. Im not exaggerating either.
lol, I went to the repo expecting to see some more detailed skill, that has instructions on checking various things/PHP install locations/things that could be using PHP that need to be checked, webservers, docker containers, etc/instructions for checking various php deployment methods on cloud providers/etc... i.e. making the skill useful so that it can check lots of places.
Nope, it just says to run php -V and has a table of vulnerable vs non-vulnerable versions.
There are lots of people who have underwent a lobotomy since discovering slop machines and have delegated literally all their work to them, so much so that calling `php --version` is too much for them.
People stuck working at companies with slop machine usage mandates will appreciate that skill too.
The first sentence of "Coordinating a global response" is "Getting a fix into use can mean adapting it for older releases"... but I guess they mean "only supported releases", as the fixes only go back as far as 8.2, which still has security support until the end of the year, but nothing for 8.1 or 8.0, and in the case of PHP there are still plenty of PHP sites on 7.x and even 5.6.
I wouldn't expect the PHP team to provide patches for versions for which security support has ended. But this seems like the kind of task that AI is especially well suited for-- rework the patch for a release that is no longer supported but still widely used. It would've been nice for people who have much older sites to be able to patch their PHP rather than have to upgrade PHP as well to get the fix.
This thread contains an enormous amount of negativity that just doesn't make sense here. OAI are giving developers and security researchers access to AI models so they can check their software for vulnerabilities. What's the problem? Sure, there's marketing around the success stories.
Some people are acting like this is only a problem because labs are releasing models that can find and exploit these vulnerabilities in the first place. This is a nonsense claim. Humans have been discovering vulnerabilities and privately weaponizing exploits just fine for decades. We are collectively raising the floor for security.
If you're using Dependabot, we built a service that automatically analyses, fixes broken checks, and (optionally) auto-merges Dependabot PRs for you so this type of update can land automatically.
> Emergency patching. When, if ever, should governments or other operators use a vulnerability to patch systems they own or are authorized to manage after losing administrative access? What safeguards should apply? We can imagine an end-state of internet-wide always-on scanning for known vulnerabilities, and either notifying site owners when one is detected or patching the system.
The wild stuff is at the end. They propose someone (who?) auto-patching even systems they don't own.
OpenAI conveniently leaves out the part where their slop machine can not discover anything but it can and does steal the work of researchers who use their fascist garbage during their work. It just happened with the PHP security hole, it happened with math before. Most of Mythos was the same.
And even hackernews falls for it, what can we expect from MSM.
So they were the cause we had systems that were vulnerable for more than a month and only the Chosen Ones had access to patches.
At this point I'm all for having zero coordination and just disclosing bugs, at least it doesn't create special class of priviledged people that get the patches first
109 comments
[ 0.74 ms ] story [ 14.2 ms ] threadI thought that logic had been widely discredited in the security community long ago.
The entire article is form over content, it boils down to obvious: economics changed, LLMs actually can check every minor release diff for security fixes, including decompiling binary files; if you have any idea how to improve process of releasing updates, tell us.
https://deadneurons.substack.com/p/php2shell-explained-php2s...
> 1 August 2026 [...] Ryan Austin finds the RCE paths, tweets a cryptographic hash on 5 August, and submits the bug and working RCE proof-of-concept to PHP between 11 August and 14 August.
> 19–24 August 2026: Wiz Research independently collides with the same bug family using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, reporting its variants on 24 August.
I get some skepticism about marketing copy, but your comment is blatantly wrong and needlessly rude.
"I think we need to put Sam Altman in jail. And I think it’ll be an instructive experience. I think it’ll be an instructive experience for the industry and for the world."
- Edward Snowden
How much time will be left in the Defender’s Window between now and an organization getting Daybreak Access?
> How did we find this?
> No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that "know your target" is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing "all bugs" with simple prompts. At least for now.
> There are some practical research implications here. LLMs may have ingested public historical vuln data, but in their default variant analysis tends to move from the newest and most prominent bugs toward nearby older code. They do not reliably begin with obscure twenty-year-old exploitation primitives. Keeping your own mental catalog of a target's vulnerability history lets you prompt that direction explicitly.
> To our knowledge, frontier AI found these vulnerabilities before attackers did
I don't know who/what Calif is and there's no link to them, so if I were only reading this article I would definitely get the impression that "AI did all the work here".
i still do. i might be the last one.
But of course there would be no marketing.
[1] From whom you stole everything in the first place.
And I doubt throwing a pile of money at OSS projects will make much difference. Those that care are already doing "100% code coverage, run ASAN and fuzzers" (we are, for example) without getting the funding, those that don't will at most make a token effort to justify the funding and leave it at that. The issue is both lack of interest in doing it and, more importantly, lack of people and time to do it. Having a third party come in, do the audit, and submit the results, means the work actually gets done rather than indefinitely deferred due to lack of time, interest, or people.
Finally, the AI audit turns up complex technical issues that no amount of testing, ASAN, and fuzzing will ever find. They're two completely different things, we've found exactly zero overlap between what SAST tools and AI has found.
Is the company selling a magical code generation machine really asking how it can backport a fix to an older version of the same software?
Is this for real?
it’s a quite simple matter to fix a bug once it’s discovered, but how to deploy and where to deploy it when it affects a supply chain?
here’s an example: you can submit a vuln at a downstream dep and they can tell you it should be patched upstream. what should you do? open an issue upstream? maybe, probably not, probably the solution is to contact all downstream deps in order to get them to migrate dep or patch, because you just reported a vuln and they shrugged it off
Just give us the damn code to verify things are working since so many have to use stopgap solutions and want to verify them
I'm sure they named it after the "Hack the planet" slogan from the Hackers movie.
So how many tokens can I put you down for.
Then, someone releases a pick that works for many more locks humans couldn't pick.
And says: You can't stop the progress. Now pay us to upgrade your locks (no-no, they won't be doctored to fit our next-gen picks, trust us!)
1. OpenAI started the current AI cycle
2. That cycle has exposed exponentially more security vulnerabilities due to agentic coding
3. OpenAI is rushing as fast as they can to reach the singularity even while acknowledging that they lack the ability to ensure reasonable safety.
4. They launch an initiative to “address” the security vulnerabilities by using their coding tools.
Am I missing something? There is a broad range of motives and responses.
I don't use these models much I just don't like unfair criticism.
> In another thread when I suggested they lied to investors and that constitutes securities fraud you questioned it in an overly dismissive manner.
I'm confused, are you posting under two identities?
The user Frieren claimed that this post constituted securities fraud. To which I responded: "You're claiming this is securities fraud?"
Is that dismissive? It was a genuine question, I don't get how it's even accurate say that they are lying in the post and I especially don't get how it is securities fraud.
Your post doesn't have anything to do with the blogpost. Once again, I'm not against criticism just unfair/weak criticism. I don't think it helps anything.
I am not posting from two profiles. I looked at your prior comments and saw you had responded to me or someone I was debating elsewhere.
similarly OpenAI was born out of the idea that the tech will exist and that they should be the oned to decide how it exists instead of other bad guys
I think if you do something you did it, imagining another bad guy doing it is not a great defense.
I assure you this is perfectly formal, and for your… “safety”.
The vulnerabilities exist and many have for decades. Find them or leave them for someone more dangerous, just don’t shoot the messengers.
Personally I’d rather we went through a short and sharp improvement and embedded a faster response cycle, than wish it away. It’s the reality of the situation; so adapt.
AI did not inject the bugs into PHP as far as i know?
Last I checked, white hat security researchers weren't making their livings selling superhuman hacking tools to unknown entities as part of ~$1T businesses desperate to offload their shares onto the public before bubbles pop.
If you want to argue what they're doing is fine regardless, be my guest, but using this comparison as the justification is a little ridiculous.
No, the people who wrote the original code with security vulnerabilities created the problem, or those who architected their language/framework/SDK to not have easy forwards compatibility.
>we are releasing the dangerous stuff
No, they are disclosing its existence, not releasing it.
OpenAI released the tool that FINDs the exploits. They don’t need to publish them to be complicit.
The problem was actually created by the people that wrote vulnerable code, the people that shipped releases containing the vulnerability, and the people that decided to run vulnerable code in production.
Worse yet, software development in general has been unable to ship code without vulnerabilities and has a weird resistance to formal methods. Software is math, computers perform mathematical operations. We can prove the shit out of them, but for some reason we don't wanna to.
Here I am hoping that agents start adding formal verification to vibe coded projects on their own, without the user asking for it.
OpenAI consistently doesn't know what they're talking about.
Who cannot type "php --version" but can use skills?
Lots of the tech world, especially the younger side is completely reliant on these things for every little thing. Im not exaggerating either.
Nope, it just says to run php -V and has a table of vulnerable vs non-vulnerable versions.
Sigh
People stuck working at companies with slop machine usage mandates will appreciate that skill too.
I wouldn't expect the PHP team to provide patches for versions for which security support has ended. But this seems like the kind of task that AI is especially well suited for-- rework the patch for a release that is no longer supported but still widely used. It would've been nice for people who have much older sites to be able to patch their PHP rather than have to upgrade PHP as well to get the fix.
Some people are acting like this is only a problem because labs are releasing models that can find and exploit these vulnerabilities in the first place. This is a nonsense claim. Humans have been discovering vulnerabilities and privately weaponizing exploits just fine for decades. We are collectively raising the floor for security.
Check it out: PatchWave (https://patchwave.ai)
(Disclosure - I am a co-founder)
The wild stuff is at the end. They propose someone (who?) auto-patching even systems they don't own.
It's been done before, though I cannot recall specific examples.
And even hackernews falls for it, what can we expect from MSM.
At this point I'm all for having zero coordination and just disclosing bugs, at least it doesn't create special class of priviledged people that get the patches first
Google used to be the laughingstock but now it's openai.
last place by far.