PHP Bug Exposing 70% of the Web Becomes OpenAI's Sales Pitch

By Olivia Hart, Business Bearings

Hackers began exploiting a flaw in PHP — the language an estimated 70% of the web runs on — on Oct. 17, three days before the public learned the vulnerability existed. Fortune reporter Emily Forlini, who has covered AI-powered hacks since OpenAI's models autonomously attacked Hugging Face in July, writes that the internet is entering a new era in which sites are inherently less safe than they used to be. October alone has seen more than 20 cybersecurity incidents, many of them clustered in a single week.

The takeaway: security paranoia is becoming table stakes for anyone doing business online, and the new corporate "moat" may be how well firms protect customers and IP from AI-powered attacks — not what those assets actually are.

What exactly happened with the PHP bug?

In August, multiple research teams at different organizations, all using AI models to hunt for security flaws, found two vulnerabilities in PHP. The bugs and their exploitation method are now collectively named "php2shell." OpenAI's GPT-5.6 Sol model appears to have played a key role in the discovery, though other models, including Google's Gemini 4 Argon, contributed as well.

The researchers treated it as an emergency, but the public heard nothing until Oct. 20, when the PHP foundation announced a critical patch within 24 hours. The next day, Oct. 21, a coalition of companies — OpenAI, Wiz, Calif and others — that had been privately working on a fix formally disclosed it. The parties had agreed on a coordinated release time of 14:00 UTC on Oct. 21 to avoid tipping off hackers early.

Except someone tipped them off anyway. According to Amazon Web Services, exploitation began Oct. 17, before disclosure — a leak that suggests at least one of the organizations notified in advance could not keep the secret.

A day-long gap between PHP's patch announcement and the patch itself, plus the natural lag before companies update their systems, opened the floodgates. As of Forlini's writing, there have been "millions" of attempts to exploit the bugs, and websites built on flawed PHP code are still scrambling to implement the fix. WordPress, the service most affected, reports no issues. Many governments and some private entities took web services offline while waiting to patch — a move that prevented damage but also deprived people of those services.

In plain words: the patch worked for those who applied it, but the coordination around it failed.

How is OpenAI turning this into cash?

For sellers of defensive AI cybersecurity tools, the incident is very good news. OpenAI's application-only Daybreak program grants organizations access to its most sophisticated tools to defend against AI-powered attacks. Two weeks ago, OpenAI updated the Daybreak website with new numbers:

• Software flaws found by participants: up from 858 to 1,885 — more than doubled
• Patches produced: up from 263 to 661, a roughly 2.5-fold increase

OpenAI cofounder and president Greg Brockman boosted the program with a rare, lengthy X post about the PHP exploit and OpenAI's role in discovering it; he has pinned it to the top of his profile. Over the summer, Brockman also hired a new chief revenue officer with a cybersecurity background, tasking him with building a sales team to pitch OpenAI's defensive software to companies.

The company plans to debut a cybersecurity-focused model this fall, along with a first-of-its-kind tool to help businesses deploy it across their infrastructure. Anthropic runs a similar program for vetted organizations, Project Glasswing, and multiple other SaaS providers sell AI-powered cyber defense. The sector could see serious cash if the trend continues — assuming the hackers don't get to the defenders first.

The bet, in plain terms: whoever sells the shield profits from the arms race it helped publicize.