OpenAI's Patch the Planet found PHP2Shell bugs in core PHP

The PHP2Shell episode is best read as a distribution and ownership problem as much as a discovery one. OpenAI places the work under Patch the Planet, a remediation initiative, while researchers credit access to Daybreak cyber models as the enabling mechanism—related roles the record warns against conflating. Credit is spread across parties: Calif/OpenAI and Wiz/Gemini as separate discovery accounts, PHP maintainers supplying the upstream fix, and Cloudflare providing pre-release filtering.

A striking feature of the supplied record is how much of the response ran on inference rather than verified primary sources. There is no direct PHP Foundation release advisory, fixed-version matrix or patch commit in the material, which the record says prevents a reliable "upgrade to version X" instruction. Cloudflare's post is described as the strongest firsthand operational evidence, yet it does not specify successful compromises, request counts or victim counts. Reported shutdowns and a figure of approximately 1.5 million unfixed servers appear in viral compilations the record says are uncorroborated.

The alarm-skeptical thread in the material separates the PHP fix from broader personal-security advice, noting that enabling two-factor authentication does not prevent exploitation of an unauthenticated PHP-engine bug. Meanwhile SemiAnalysis's separate reporting on 18 Japanese companies disclosing breaches since September 25 is presented as distinct incidents that do not establish PHP2Shell as their entry point. Participants including Eric Wallace and Greg Brockman describe the two-month coordination, but the record notes these are participant accounts, not an independently audited timeline.