GPT-5.6 Sol Found Critical PHP Zero-Days Before Attackers — OpenAI Commits $1B to Defenders
GPT-5.6 Sol found critical security flaws in PHP before any attacker did. Over the past two months, cybersecurity research firm Calif, operating under OpenAI’s Patch the Planet initiative, identified the vulnerabilities and triggered a coordinated disclosure process involving PHP’s maintainers, Wiz, Cloudflare, and government cybersecurity agencies.
Wiz independently discovered and reported both flaws as well. PHP maintainers led the patches; OpenAI, Wiz, and Cloudflare contributed research, technical support, and pre-disclosure protections. Government cyber agencies were engaged to push guidance to critical organisations.
OpenAI described it as “one of the most impactful security issues in recent memory.”
The Defender’s Window
The key operational concept: AI found the bugs first, opening what OpenAI calls a Defender’s Window — time for maintainers and security providers to prepare and deploy protections before any attacker could weaponise the same discovery.
That window is the thing the security industry has always wanted and rarely had. Most zero-days arrive after an attacker has already used them. Here the sequence flipped.
OpenAI has published a PHP version checker as a Codex skill on GitHub to help operators assess exposure and identify applicable patches.
Scale: $1 Billion for Defenders
OpenAI committed $1 billion in subsidised Daybreak access specifically for organisations with limited security resources protecting essential services. This is not a blanket API credit. It targets the constituency least likely to afford frontier model access — critical infrastructure defenders, public health systems, smaller utilities.
The implication: OpenAI expects this type of discovery to happen repeatedly and wants the defensive response infrastructure in place before the next one.
The Harder Problem
PHP powers a substantial portion of the web. The coordination required to patch, test, and deploy a fix across the ecosystem — adapting for older releases, coordinating provider mitigations, pushing guidance through government channels — is a logistics problem as much as a technical one.
OpenAI is publishing a proposed response framework specifically for AI-era vulnerability disclosure. The framework attempts to scale the human-led process: maintainers stay in charge, but AI and coordinating organisations compress the timeline from discovery to protection.
OpenAI explicitly noted that the same AI capabilities that find vulnerabilities can also help attackers develop exploits faster. They’re betting the Defender’s Window can be kept open if the response infrastructure matures at the same pace as the discovery capabilities.
More AI-discovered vulnerabilities are coming. The question is whether the coordination layer can absorb them.