OpenAI's Patch the Planet finds critical PHP flaws in code behind 70% of web
Read original source →openai.com
GPT-5.6 Sol helped Calif researchers find PHP2Shell (CVE-2026-109618, CVE-2026-109619) in August; OpenAI found a fuller version in September, and Wiz found both independently. The bug sat in PHP for 14 years, and OpenAI led a two-month coalition to coordinate fixes.
People · Greg Brockman, Matthew Prince
How this story unfolded
3 days · 9 reports · 4 community posts · 13 of 15 shown
- Oct 21
- Oct 22
Cloudflare links vulnerability discovery to defense with OpenAIopenai.com
[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 monthslatent.space
OpenAI Helped Find Potentially Catastrophic Cyber Flawbloomberg.com
OpenAI Helped Find Potentially Catastrophic Cyber Flawyoutube.com
PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (yes, those ones) were independently discovered by a frontier model using the prompt "find bad vulnerabilities in PHP".
- Oct 23
- Oct 24
More stories today
Reddit user urges artists to mirror models to Hugging Face amid CivitAI removals
A r/StableDiffusion post asks artists to upload models and LoRAs to Hugging Face as well as CivitAI, citing body-size sliders being deleted for MOSS image. The poster argues CivitAI is removing anything usable in ways that break its ToS.
r/StableDiffusion·1 hour agoTweet recounts 21-year-old's breakup with an AI chatbot character
Nav Toor·2 hours ago
Reddit post argues KLD can't rank quantized model quality
A r/LocalLLaMA post pushes back on treating KL divergence as a definitive metric for comparing quantized models, arguing it cannot distinguish every quantized model or rank them by quality. The author explains what KLD actually measures by feeding identical text to base and quantized models.
r/LocalLLaMA·2 hours agoTogether AI hosts GTC Berlin developer sessions
Together AI·2 hours ago
Arize AI engineer details five-step agent regression loop
A one-line prompt change made a support agent 17 points safer but 17 points worse at completing tasks, per Sofia Jakovcevic of Arize AI. She argues agents fail at runtime rather than in code and outlines a five-step regression loop built from production traces.
YouTube·3 hours ago
OpenAI reportedly discounts to win Anthropic coding customers
Kimmonismus·3 hours ago
Pennsylvania requires labels on AI-generated ads
Gov. Josh Shapiro signed the Artificial Intelligence Deceptive Advertising Act, requiring image, video, audio, or text ads "significantly modified or generated by" AI to carry a label in the same format as the ad. The law exempts parody, satire, commentary, and "evidently fictional" content, and applies regardless of where an ad was created.
The Verge·3 hours ago

Reddit post claims AI has hit a wall on ARC-AGI-3
A r/Singularity post argues ARC-AGI-3, designed to be especially hard for AI, has stalled progress, with the poster joking that Chollet now needs an ARC-AGI-4. The post shares only a chart image and no benchmark scores or sourcing.
r/Singularity·4 hours ago