Key points
- The framework emerged from a two-month response to vulnerabilities found in PHP.
- OpenAI expects the volume of AI-discovered bugs to increase sharply in coming months.
- The process includes early access for distributors and engagement with government agencies.
OpenAI has proposed a five-stage process for managing critical vulnerabilities in widely used software, according to Help Net Security. This framework developed during a two-month response to flaws in PHP, an open-source language powering many websites and web applications. The initiative aims to coordinate fixes when artificial intelligence tools discover bugs that could affect numerous products simultaneously.
In plain English
The new process addresses the challenge of rapid vulnerability discovery by AI models. OpenAI stated that significant bugs like those found in PHP are part of a growing trend. The company expects similar findings to increase sharply in the coming months as AI tools become more broadly available, including to potential attackers. This creates pressure on developers and service providers who need time to prepare and deploy fixes before exploits are widely used.
The background
Calif discovered one of the PHP flaws using OpenAI’s GPT-5.6 Sol model through the Patch the Planet initiative. Wiz independently found and reported both vulnerabilities. OpenAI noted that these bugs are among several significant vulnerabilities they have already identified and are working to fix. The framework is designed for flaws that reach many products at once, requiring coordinated action from distributors, hosting providers, and security vendors to mitigate risk effectively.
What changes now
The five-stage framework begins with maintainers and partners confirming the bug and testing fixes, including using frontier models to hunt for workarounds. Second, affected organizations receive early access to adapt fixes or write firewall rules. Third, responders engage government bodies like CISA and the White House. Fourth, maintainers widen the circle to more operators once plans settle. Fifth, post-patch guidance and deployment support continue.
Who needs to act first
Security teams should prioritize updating systems that face the internet or handle sensitive data. Organizations should verify if their software versions are affected before rolling out changes. It is wise to test patches in isolated environments first to ensure stability. Teams should also review web application firewall rules to block known malicious traffic patterns. Backing up critical data before applying updates helps prevent operational disruptions. Coordinating with internal IT staff ensures a smooth and safe deployment process across all affected systems.
What to do and how to stay safe: OpenAI
- Check if your organization uses PHP or other widely adopted open-source software mentioned in vendor advisories.
- Monitor official channels from maintainers for early access to fixes or mitigation guidance.
- Review and update web application firewall rules to filter potentially malicious traffic while waiting for patches.
- Ensure your incident response plan includes steps for coordinating with government agencies and distributors.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What triggered the creation of this five-stage process?
The process grew out of a two-month response to vulnerabilities found in PHP, with one flaw discovered using OpenAI’s GPT-5.6 Sol model.
Who gets early access to vulnerability details?
Access is determined by an organization’s protective role, the time needed to act, and its ability to handle sensitive information, with maintainers making the final call.
What government agencies are involved in this framework?
For PHP, OpenAI and partners engaged the White House’s Super Intelligence Force, the Office of the National Cyber Director, CISA, and international partners.
