If you’re running PHP, you patched yesterday. Or you should have.

Two remote code execution vulnerabilities hit every supported PHP 8.x version on October 21st, and the timeline was a mess. The bugs leaked early, exploits started circulating by Monday night, and the PHP Foundation scrambled to coordinate a response while the internet caught fire.

The twist: AI found these bugs.

According to OpenAI’s announcement, their AI agents discovered the vulnerabilities as part of a new initiative called Patch the Planet. It’s a coordinated disclosure program connecting security researchers (in this case, AI agents), package maintainers, and incident responders to identify and fix critical vulnerabilities in open source software.

The system worked exactly as designed, until it didn’t.

When Coordinated Disclosure Leaks

The PHP Foundation’s postmortem makes it clear: the CVE IDs started circulating on forums Tuesday afternoon, around 15:00 UTC. By that evening, working exploits were in the wild. The patches weren’t supposed to drop until the next day.

This is the nightmare scenario for security teams. Coordinated disclosure only works if everyone keeps their mouth shut until the patches are ready. When that timeline collapses, you get exactly what happened here: a race between admins scrambling to patch and attackers scrambling to exploit.

Both vulnerabilities allow remote code execution. That’s the worst-case scenario. An attacker doesn’t need credentials, doesn’t need to be on your network, just needs to find your server. The PHP Foundation hasn’t published full technical details yet (and probably won’t for a while), but the severity is clear from the response.

AI as Security Researcher

OpenAI’s Patch the Planet is the first real-world deployment of AI agents as vulnerability hunters at scale. The program runs automated analysis across open source codebases, flags potential security issues, and routes them through proper disclosure channels.

This isn’t hypothetical anymore. AI just found production vulnerabilities in one of the most widely deployed programming languages on the planet. PHP powers somewhere between 75-80% of websites with a known server-side language. WordPress, Laravel, Drupal, MediaWiki, all the stuff holding the internet together.

The implications are huge. If AI can find these bugs, it can find them faster than humans. That’s good news if the AI is working for the defenders. It’s very bad news when the disclosure process fails and the bugs leak before patches are ready.

What This Means For Developers

First, patch. If you haven’t already, update to the latest PHP 8.x release. This isn’t optional.

Second, pay attention to Patch the Planet. OpenAI is positioning this as ongoing infrastructure. They’re not just running one-off scans, they’re building a system for continuous vulnerability discovery across the open source ecosystem.

If you maintain open source software, you might get a disclosure from an AI agent. The PHP Foundation’s post suggests they’re working on better processes for this exact scenario, because this won’t be the last time.

Third, assume the disclosure timeline is always shorter than you think. The old model of coordinated disclosure gave everyone 90 days to patch. That assumed human researchers finding bugs at human speed, and human disclosure processes that mostly stayed secret. AI changes both sides of that equation. Bugs get found faster, and secrets leak faster.

The Recursive Flint Footnote

In a week where AI security research just proved itself at scale, it’s worth noting that Recursive launched Flint, a coding model they claim was largely built by their own AI systems. It’s a laptop-sized model, free to use, and positioned as a test of self-improving AI.

The timing is coincidental, but the theme is consistent. AI building AI, AI finding bugs in human code, AI as both the solution and the next problem to solve.

For now, go patch your PHP servers.