Patch the Planet Coordinates Global Response to AI-Discovered PHP Flaws

Over the past two months, a coalition of open-source maintainers, security researchers and industry providers coordinated a global response to critical vulnerabilities in PHP, the widely used programming language that underpins a large share of websites and web applications. The response was led under the Patch the Planet initiative, which said the flaws were identified using GPT-5.6 Sol, while security firm Wiz independently discovered and reported the issues. PHP maintainers led the technical fixes and software release, with support from partners including Wiz, Cloudflare and other security and infrastructure providers that contributed research, testing, coordination and preparatory protections before public disclosure. The initiative described the vulnerabilities as among the most impactful security issues in recent memory because of PHP’s broad deployment and the severity of the flaws. It said frontier AI systems identified the problems before attackers did, creating a defender’s window that allowed maintainers and security teams to develop fixes and protections ahead of disclosure. The episode also highlighted the dual-use nature of advanced AI, which can accelerate defensive vulnerability discovery but could also enable attackers to build exploits and offensive tools more rapidly. To strengthen defensive readiness, the initiative announced a commitment of $1 billion in subsidized access to Daybreak capabilities through its Daybreak for Frontline Defenders program, aimed at organizations with limited security resources that protect essential services. It also proposed a repeatable response framework for critical vulnerabilities in widely used software, built around five stages: validating and fixing the upstream issue; giving affected organizations time to prepare protections; coordinating with government partners; preparing updates across distributors, hosting providers, service providers and operators; and publishing guidance to support deployment and recovery. The framework calls for risk-calibrated information sharing, including sensitive proof-of-concept exploit material where needed for defensive work, while weighing the risk of premature leakage. For the PHP case, the coalition engaged U.S. government bodies, including the White House Super Intelligence Force, the Office of the National Cyber Director and the Cybersecurity and Infrastructure Security Agency, as well as international partners, to help extend guidance to critical-infrastructure operators. The effort also included practical defender support, such as public disclosures, upgrade instructions, interim mitigations, provider guidance and access to remediation resources. The initiative said it is supporting open-source maintainers through engineering assistance, model access, funding and programs including Codex for OSS and sponsorship of projects such as the Rust Foundation. It also plans to refine misuse safeguards in Daybreak and seek community feedback to improve its proposed AI-era vulnerability response model.