OpenAI and Wiz expose PHP vulnerabilities, raising AI security paradox

The simultaneous discovery by competing labs suggests PHP vulnerabilities are now low-hanging fruit for frontier models, raising questions about whether this reflects genuine breakthrough in AI reasoning or simply that both teams are running the same automated scans. The real news is the coordination problem: if OpenAI and Google both found it independently, how many other actors already knew?

This is the logical endpoint of the Patch the Planet initiative OpenAI launched on the same day. The program pairs AI agents with human maintainers to find zero-days at scale, and this PHP discovery is its first high-profile output. But it also extends the pattern from the OpenCode breach (October 19) and the John Deere multi-agent campaign (October 19), where the same AI capabilities that detect exploits are now operational weapons. The gap between discovery speed (hours, per the SentinelOne piece) and patch deployment remains the actual bottleneck. Responsible disclosure assumes time for remediation; AI-accelerated finding compresses that window.

If the PHP patches land within 72 hours of disclosure, Patch the Planet's coordination model works and becomes a template for open-source maintenance. If patches lag beyond two weeks, the program has merely accelerated the discovery side of an asymmetric equation, making the vulnerability window wider for attackers with access to the same models.