SHELFCRITTER AI Digest

TOPIC

Patch the Planet

topictopic-noteagent-security

Overview

Patch the Planet is OpenAI-owned branding for the coordinated-disclosure program under which the lab routes AI-discovered CVEs through third-party partners. Part of the Daybreak initiative, Patch the Planet launched in June 2026 with Trail of Bits and HackerOne as named partners and has already surfaced Firefox WebAssembly and dnsmasq CVEs. The Oct 21 batch disclosure patching a critical PHP RCE jointly surfaced by GPT-5.6 Sol and Wiz (using Gemini 4 Argon) is the program’s highest-blast-radius result to date.

Timeline

  • 2026-10-22-AI-Digest — OpenAI‘s Oct 21 Patch the Planet disclosure patches a critical PHP RCE jointly surfaced by GPT-5.6 Sol and Wiz (using Gemini 4 Argon). The PHP Foundation shipped a fix on Oct 21. Load-bearing clarification: Patch the Planet is OpenAI-owned branding (part of the Daybreak initiative), the Oct 21 event is a batch disclosure under that program, not the program’s debut. Reframe worth carrying: this is the latest in a running series of AI-assisted CVE discoveries now reaching higher-blast-radius software — not the first AI-discovered CVE (Google’s Big Sleep shipped SQLite CVE-2025-6965 in October 2024; Patch the Planet itself, launched June 2026 with Trail of Bits and HackerOne as partners, had already surfaced Firefox WebAssembly and dnsmasq CVEs). Fortune’s more dramatic framing — PHP2Shell naming, country-outage lists, Cloudflare same-day attacker-exploitation claim — did not corroborate independently; the first-party-confirmable core is the OpenAI + Wiz joint discovery. Log against MOC - Agent Security.

Key Developments

  1. Critical PHP RCE Jointly Discovered by GPT-5.6 Sol and Wiz Using Gemini 4 Argon (October 21, 2026): The PHP Foundation shipped a fix on Oct 21 for a critical PHP flaw surfaced under Patch the Planet. OpenAI credits GPT-5.6 Sol for the discovery; Wiz independently reported the same flaw using Gemini 4 Argon. Load-bearing framing: AI-assisted CVE discovery is a running series now reaching higher-blast-radius software, not first AI-discovered CVE.

See also: OpenAI, Wiz, GPT-5.6 Sol, Gemini 4 Argon, Daybreak, MOC - Agent Security.