OpenAI announced today that their AI model (through the 'Patch the Planet' initiative) helped discover a major security vulnerability in PHP. PHP is the language used by approximately 70% of websites globally (WordPress, Drupal, and many enterprise systems run on it), so the impact is huge. This vulnerability, named PHP2Shell (CVE-2026-109618 / CVE-2026-109619), stems from memory management issues in the PHP engine. Under certain conditions, attackers can remotely execute code (RCE), and the severity has been rated as critical. Teams from OpenAI, Calif, Wiz, and others worked together to identify the issue. They spent about two months coordinating with PHP maintainers, Cloudflare, Wiz, and other security vendors to prepare patches and protective measures before making the vulnerability public. OpenAI refers to this time window as the Defender’s Window: when AI discovers vulnerabilities before attackers, giving defenders time to prepare. The official patch has now been released, and websites using PHP are strongly advised to upgrade as soon as possible or apply temporary protections provided by security vendors. The significance of this event lies in the fact that AI is now capable of identifying vulnerabilities at the 'entire internet impact' level, not just regular coding issues. For the first time, defenders have a chance to stay ahead of attackers, but how long this advantage can last remains uncertain.