OpenAI names the PHP flaw it helped find, then ships a free checker to find exposed sites

The vulnerability now has a name because of who found it first. Under OpenAI’s Patch the Planet initiative, a researcher at security firm Calif used GPT-5.6 Sol to find the first bug on August 1 and reported it to the PHP project on August 11. Wiz, now part of Google Cloud, independently landed on the same flaws around August 19 using Gemini 4 Argon and its own Wiz Atlas tooling. OpenAI president Greg Brockman described roughly two months of coordinated remediation that followed, involving PHP’s maintainers, security vendors, and government bodies, before the October 21 public disclosure.

OpenAI followed the disclosure with a free checker, published as a GitHub repository under its own account rather than a third party’s. The tool, phpcheck.js, is also packaged as two Codex skills, phpcheck-url for checking a site by URL and phpcheck-server for when you already have access to the machine running it. Point it at a site and it reads the X-Powered-By and Server HTTP headers, falling back from a HEAD request to GET only if the server returns 405 or 501; point it at a local install and it just runs php -v. Either way, it compares the detected version against a hardcoded cutoff for each PHP branch and returns OK, VULNERABLE, or UNKNOWN, nothing more invasive than that.

The README is upfront about where that falls short. A result of UNKNOWN, missing headers, an unrecognized version, a prerelease build, doesn’t mean a site is patched, and the tool explicitly says so. Version comparison alone can also miss the real picture: distributions that backport the fix without bumping the version string, or servers that hide their headers entirely, will read as unverifiable rather than safe. OpenAI frames the check as a starting point for figuring out exposure, not a substitute for confirming the fix against PHP’s own security release notes.