Updated

Updated · OpenAI · Oct 21

OpenAI Leads PHP Flaw Response, Commits $1 Billion as AI Finds 2 Critical Vulnerabilities

Updated

Updated · OpenAI · Oct 21

OpenAI Leads PHP Flaw Response, Commits $1 Billion as AI Finds 2 Critical Vulnerabilities

Q: Who ultimately decides which open-source projects qualify for OpenAI's new $1 billion security fund to protect critical infrastructure?

OpenAI ultimately decides eligibility, because it is administering the program and has not published an independent selection body or formal rulebook for open-source projects. The material available shows this is not a conventional cash fund with fixed grant criteria. OpenAI describes it as $1 billion in subsidized Daybreak access, training, technical support and partnerships, with open-source maintainers named as one priority group. But the application language is explicit that submitting interest “does not guarantee eligibility, funding, model access, partner services, or a particular timeline.” That means there is no publicly disclosed outside panel, government board or open-source foundation making the final call. OpenAI may consult partners through programs such as Codex for OSS, Patch the Planet, Trail of Bits, or government and infrastructure collaborations, but the final determination appears to remain with OpenAI under internal review. For open-source projects specifically, the clearest practical answer is that maintainers can apply, but the standards for approval, allocation and timing have not been fully published. In effect, OpenAI has reserved discretion over which projects qualify and what support they receive.

3 articles · Updated · OpenAI · Oct 21

OpenAI said it spent the past two months coordinating a global response to two critical PHP vulnerabilities, after Calif found one with GPT-5.6 Sol and Wiz independently reported both flaws.
PHP maintainers issued the fixes, while OpenAI, Wiz, Cloudflare and other partners tested patches, prepared provider protections and shared a PHP version-checking Codex tool to help operators identify affected systems.
U.S. agencies including CISA, the ONCD and the White House’s Super Intelligence Force were engaged alongside international partners to help push guidance to critical organizations before public disclosure.
OpenAI said frontier AI appears to have found the bugs before attackers did, creating a 'Defender’s Window' but also underscoring that the same capabilities could speed exploit development.
$1 billion in subsidized Daybreak access will be offered to frontline defenders, as OpenAI pushes a five-stage framework for handling future AI-discovered vulnerabilities in widely used software.

Sources

Left67%

Right33%

OpenAI10h ago

OpenAI Leads Global Coalition to Patch Critical PHP Vulnerabilities Discovered by AI

bbc.co.uk2h ago

Websites taken down as critical PHP cyber-security update issued - BBC News

Dunya News1m ago

Cyber agency warns websites may go dark as PHP prepares critical fix | Dunya News

10 Sources

As AI systems independently discover critical zero-days, how will defenders outpace malicious actors using the exact same technology?

Who ultimately decides which open-source projects qualify for OpenAI's new $1 billion security fund to protect critical infrastructure?

With reports of leaked embargoes, does a coordinated 'Defender's Window' actually protect systems, or just create a false sense of security?

The PHP2Shell Crisis: How AI Uncovered and Helped Patch the Decade-Old Vulnerability Impacting 70% of the Web

Overview

The October 2026 PHP2Shell crisis began when AI-powered audits by Calif and Wiz Research uncovered decade-old memory safety flaws in PHP, leading to a coordinated defense effort with OpenAI, major cloud providers, and the PHP Foundation. After a public leak forced early disclosure, emergency patches and web firewall rules were rapidly deployed, but attackers began exploiting the flaws immediately. Governments advised taking unpatched systems offline, causing service disruptions for critical infrastructure like Dutch government portals. To support defenders, OpenAI committed $1 billion in AI cybersecurity resources, helping organizations like municipal water utilities patch systems without downtime. This event highlights the power of AI in both discovering and defending against large-scale software vulnerabilities.

...