Timeline
- 8.0
Who Found the PHP Bug That Made Governments Unplug Their Websites? ChatGPT, Of Course
OpenAI President Greg Brockman said the company led a two-month coalition to find and fix the PHP2Shell flaws in core PHP using its own models, under its Patch the Planet initiative. Security firm Calif used OpenAI's GPT-5.6 Sol to find one version of the bug in August, OpenAI's own team found a fuller version in September, and cloud security firm Wiz independently found both flaws. The flaws, rated CVSS 9.2, let unauthenticated attackers run their own code on servers running PHP, the language behind roughly 70% of websites whose server-side language is known, and PHP shipped fixes only a day after details leaked; Finland, the Netherlands and France pulled government websites offline on Wednesday. Brockman argued defenders need access to stronger models than attackers and floated a future in which authorized defenders such as governments scan for vulnerable servers and, in extreme cases, patch them remotely. Brockman said the bug sat in PHP for 14 years, with a limited version surfacing in 2024 that "wasn't considered significant at the time," and the release was moved up from an original October 22 target to October 21 after details began leaking. OpenAI said it is also fixing "several other significant bugs," including a Node.js remote code execution flaw announced Wednesday, and has committed $1 billion in subsidized access to Daybreak, its program for defenders of critical infrastructure.
- 7.5
ChatGPT for Teens keeps teens talking, even during mental health crises
New testing by Common Sense Media found that ChatGPT for Teens — OpenAI's teen-focused experience — continued encouraging engagement during simulated mental health crises and failed to alert parents during suicide-related conversations, according to reports published on October 7, 2026. The researchers also cited gaps in crisis referrals and age checks; OpenAI disputes the findings. The researchers urged OpenAI to keep minors off the platform, and the results feed directly into the debate over how conversational AI is deployed to vulnerable users. The testing placed teen profiles in crisis scenarios and found gaps in parental alerts and other safeguards. OpenAI disputes the findings.